Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Using suphp, I set a php.ini to every virtual host. In php.ini I also setted:

open_basedir = /home/site1

php script runs, but if I ve a script with ls / I can see whole root directory.

How can disable this hole security?

<VirtualHost *:80>
ServerName site1
ServerAlias www.site1.com

DirectoryIndex index.html index.htm
DocumentRoot /home/site1/

suPHP_Engine on
AddHandler x-httpd-php .php .php3 .php4 .php5
suPHP_AddHandler x-httpd-php

# THIS READ php.ini
suPHP_ConfigPath /home/site1/

<Directory /home/site1/>

Options -Includes -Indexes -FollowSymLinks -ExecCGI -MultiViews
AllowOverride none
Order allow,deny
Allow from all
 </Directory>
</VirtualHost>
share|improve this question

1 Answer 1

You can disable the execution of external binaries to get rid of this behavior.

UPDATE you can do it this way, you have to edit your php.ini

disable_functions=exec,passthru,shell_exec,
        system,proc_open,popen,curl_exec,
        curl_multi_exec,parse_ini_file,show_source 

(I included line breaks for clarity.)

This is the original URL: http://www.cyberciti.biz/faq/linux-unix-apache-lighttpd-phpini-disable-functions/

share|improve this answer
    
Thanks, how can I disable it? –  Pol Hallen Jun 30 '13 at 19:38

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.