The server administrator deactivated ini_set() and believes that activating it is very effective in server security, and I receive the following warnings on my websites.

Warning: ini_set() has been disabled for security reasons in drupal_environment_initialize() (line 687 of /var/www/html/website/includes/bootstrap.inc).
Warning: ini_set() has been disabled for security reasons in drupal_environment_initialize() (line 690 of /var/www/html/website/includes/bootstrap.inc).
Warning: ini_set() has been disabled for security reasons in drupal_environment_initialize() (line 691 of /var/www/html/website/includes/bootstrap.inc).

Now, when adding a node, in some cases, the content is not saved, and I believe this problem is due to having disabled ini_set().

The server administrator wants the documentation from me. I did a research on Google, but I did not find anything.

Please let me know if you have any documentation.


In some Shared Hosts they disabled some PHP functions for security reasons,

But I think you don't really understand how eval and those functions are exploited. The problem occurs when programmers do not sanitize properly the ARGUMENTS that are passed to them.

The php shell offender script that you mentioned is just a simple PHP script passing arguments to those functions. But the attackers already had a way of injecting/uploading the malicious script. If you are not using these functions at all nor passing arguments from user input, attackers can't run arbitrarily code on your server using eval() or relatives.

Are you going to be hosting this framework for your users? If you are allowing users to upload and run code then you have a bigger problem in your hands.

I've been working with Drupal Since 2009 and in the most Drupal webiste cases which have been hacked EVALand base64_decode functions played the main roles not ini_set, I don't know anything about where is you host provider, but for top Drupal host providers like https://www.siteground.com/, https://pantheon.io/,https://platform.sh/ and https://www.acquia.com ini_set is not disabled and if your server admin can hack them I'll appreciate him/her. Security is not single dimension concern, there are a lot of parameters we have satisfy to stay safe.

In some Hosts they let you customize your php.ini ( https://www.plothost.com/kb/disable-dangerous-php-functions-web-hosting-server/)

How to enabled ini_set() which has been disabled for security reasons By default, some php functions has been disabled by admin due to security reasons. In some cases, you may need to enable it for in order to run your web application or web content.

To do so, please refer following steps:

  1. create php.ini file inside your working directory, or directory where you have installed your script. Copy, paste following code and save:

disable_functions = allow_url_fopen, escapeshellarg, escapeshellcmd, ini_alter, passthru, parse_ini_file, popen, proc_open, proc_close, proc_terminate, proc_get_status, proc_nice, readfile, show_source, system

  1. Reload your website to see any php errors.

Other side if you take a look at warnings issue place you'll see

ini_set('magic_quotes_runtime', '0');
  // Use session cookies, not transparent sessions that puts the session id in
  // the query string.
  ini_set('session.use_cookies', '1');
  ini_set('session.use_only_cookies', '1');
  ini_set('session.use_trans_sid', '0');
  // Don't send HTTP headers using PHP's session handler.
  // An empty string is used here to disable the cache limiter.
  ini_set('session.cache_limiter', '');
  // Use httponly session cookies.
  ini_set('session.cookie_httponly', '1');

(but there are another ini_set in Drupal), in my opinion, it's better if your host admin doesn't insist on this. Not very important item in his/her agenda. Almost all of PHP CMS and Frameworks needs this configuration option for PHP to have better performance, and you if can't change your host or change his/her attitude, it's better to find all ini_set in all over your Drupal project and give them to you sys admin to set them in php_ini. Something like memory_limi, max_execution_time session configuration could make affect your performance.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy