Facebook
Twitter-
Halloween is coming! To celebrate the occasion, we dusted off a couple of old skins, and even created a brand new one (Pixel).
To get into the festive spirit, install the Skins extension. -
The new Python extension is now available. It allows customers to deploy and manage WSGI-based Python applications on their websites directly from Plesk.
-
The Plesk Mobile apps for iOS and Android and the Plesk Mobile Center extension have been deprecated, and are no longer available for new installations. In Plesk Obsidian 18.0.84, the Plesk Mobile Center extension will be removed from servers during the upgrade, and the Plesk Mobile apps will lose their server management features.
-
The Social Login extension has been deprecated and will be removed in Plesk Obsidian 18.0.84. After that, it will no longer be possible to log in to Plesk with a Google, Facebook, GitHub account, or with a passkey. Plesk usernames and passwords, as well as logging in with a WebPros Account, are not affected.
Resolved How to disable PHP @eval function?
- Thread starter raytracy
- Start date
-
- Tags
- php eval hacking
alexonb
Basic Pleskian
add to php.ini on plesk by disable_function = eval, phpinfo, etc...
raytracy
Basic Pleskian
It sounds like eval cannot be disabled via php.ini since it is not a real function?
https://www.google.com.tw/webhp?sourceid=chrome-instant&ion=1&espv=2&ie=UTF-8#q=php.ini disable_functions eval
U
UFHH01
Guest
Hi raytracy,
pls. don't rely on informations you found over the internet. The answer from @alexonb is absolut correct and forbids the usage of the PHP command "eval". Just be informed, that you might have several PHP.ini (s) on your server, especially, when you use additional PHP - versions.
If you don't trust the answer, just test it for yourself, once with the "disable_function" in your depending "php.ini" and once without it and see your log - files, to ensure, what the settings restricts.
pls. don't rely on informations you found over the internet. The answer from @alexonb is absolut correct and forbids the usage of the PHP command "eval". Just be informed, that you might have several PHP.ini (s) on your server, especially, when you use additional PHP - versions.
If you don't trust the answer, just test it for yourself, once with the "disable_function" in your depending "php.ini" and once without it and see your log - files, to ensure, what the settings restricts.
raytracy
Basic Pleskian
I have tested it and found disable_function did not work.
Here is my work:
1. add disable_function = "eval" to /opt/plesk/php/5.6/etc/php.ini since I am using php 5.6
2. Create a php webpage from official php eval sample: http://php.net/manual/en/function.eval.php
3. Execute the php page and inspect the result page
I found the eval function always be evaluated what ever I have or have not add disable_function="eval" to php5.6 ini.
My system are CloudLinux 7.2, Plesk 12.5 mu#49
Is there any suggestion to correct it?
Here is my work:
1. add disable_function = "eval" to /opt/plesk/php/5.6/etc/php.ini since I am using php 5.6
2. Create a php webpage from official php eval sample: http://php.net/manual/en/function.eval.php
3. Execute the php page and inspect the result page
I found the eval function always be evaluated what ever I have or have not add disable_function="eval" to php5.6 ini.
My system are CloudLinux 7.2, Plesk 12.5 mu#49
Is there any suggestion to correct it?
U
UFHH01
Guest
Hi raytracy,
due to the fact, that the "disable_functions" - option at your "depending php.ini" will not completely deactivate the "eval" - function, consider to use the "suhosin" - module.
Have a look at the new "How-To", I just created for this propose: => [How-To] Install suhosin - module and configure it ( suitable for multible PHP - versions )
due to the fact, that the "disable_functions" - option at your "depending php.ini" will not completely deactivate the "eval" - function, consider to use the "suhosin" - module.
Have a look at the new "How-To", I just created for this propose: => [How-To] Install suhosin - module and configure it ( suitable for multible PHP - versions )
raytracy
Basic Pleskian
That's great! It is what I need.....Thanks a lot!!Hi raytracy,
due to the fact, that the "disable_functions" - option at your "depending php.ini" will not completely deactivate the "eval" - function, consider to use the "suhosin" - module.
Have a look at the new "How-To", I just created for this propose: => [How-To] Install suhosin - module and configure it ( suitable for multible PHP - versions )
