In some Shared Hosts they disabled some PHP functions for security reasons,
But I think you don't really understand how eval and those functions
are exploited. The problem occurs when programmers do not sanitize
properly the ARGUMENTS that are passed to them.
The php shell offender script that you mentioned is just a simple PHP
script passing arguments to those functions. But the attackers already
had a way of injecting/uploading the malicious script. If you are not
using these functions at all nor passing arguments from user input,
attackers can't run arbitrarily code on your server using eval() or
Are you going to be hosting this framework for your users? If you are
allowing users to upload and run code then you have a bigger problem
in your hands.
I've been working with Drupal Since 2009 and in the most Drupal webiste cases which have been hacked
base64_decode functions played the main roles not
ini_set, I don't know anything about where is you host provider, but for top Drupal host providers like https://www.siteground.com/, https://pantheon.io/,https://platform.sh/ and https://www.acquia.com
ini_set is not disabled and if your server admin can hack them I'll appreciate him/her. Security is not single dimension concern, there are a lot of parameters we have satisfy to stay safe.
In some Hosts they let you customize your
php.ini ( https://www.plothost.com/kb/disable-dangerous-php-functions-web-hosting-server/)
How to enabled ini_set() which has been disabled for security reasons
By default, some php functions has been disabled by admin due to
security reasons. In some cases, you may need to enable it for in
order to run your web application or web content.
To do so, please refer following steps:
- create php.ini file inside your working directory, or directory where you have installed your script. Copy, paste following code and
disable_functions = allow_url_fopen, escapeshellarg, escapeshellcmd,
ini_alter, passthru, parse_ini_file, popen, proc_open, proc_close,
proc_terminate, proc_get_status, proc_nice, readfile, show_source,
- Reload your website to see any php errors.
if you take a look at warnings issue place you'll see
// Use session cookies, not transparent sessions that puts the session id in
// the query string.
// Don't send HTTP headers using PHP's session handler.
// An empty string is used here to disable the cache limiter.
// Use httponly session cookies.
(but there are another
ini_set in Drupal), in my opinion, it's better if your host admin doesn't insist on this. Not very important item in his/her agenda. Almost all of PHP CMS and Frameworks needs this configuration option for PHP to have better performance, and you if can't change your host or change his/her attitude, it's better to find all
ini_set in all over your Drupal project and give them to you sys admin to set them in
php_ini. Something like
max_execution_time session configuration could make affect your performance.