How to prevent filesystem browsing with php shell scripts?

Vincent Lauton

Updated December 05, 2024 19:10

kb: how-to Plesk for Linux ABT: Group A

Applicable to:

PHP shell script was uploaded under the home directory of subscription.

How to prevent filesystem browsing with php shell scripts?

It's possible to disable shell_exec and other functions in PHP by using the disable_functions directive:

Warning: Applications may rely on these functions and may not work properly when restrictions are applied.

For Plesk Onyx 17.8 and newer

Login to Plesk
Navigate to Domains > example.com > PHP Settings
Set the following value to the disable_functions:

CONFIG_TEXT: opcache_get_status,exec,passthru,shell_exec,system,proc_open,popen

Note: To set the restriction to multiple domains at once, this value can be specified in Service Plans > <service_plan> > PHP Settings > disable_functions, or to apply it server-wide, in panel.ini as settings.performance.disable_functions

For Plesk Onyx 17.5 and older

Login to Plesk
Navigate to Domains > example.com > PHP Settings
Add the following line under Additional configuration directives and apply the changes:

CONFIG_TEXT: disable_functions=opcache_get_status,exec,passthru,shell_exec,system,proc_open,popen