Applicable to:
- Plesk Onyx 17.8 for Linux
Symptoms
-
The directive disable_functions cannot be changed using the article How to disable PHP functions globally?
-
After changing the directive disable_functions in Plesk in Domains > example.com > PHP Settings, domain's phpinfo still shows the old value.
-
The configuration file
/var/www/vhosts/system/example.com/etc/php.inicontains the default value:# grep "disable_functions" /var/www/vhosts/system/example.com/etc/php.ini
disable_functions = "opcache_get_status"
Cause
This is Plesk bug PPPM-9216, which is planned to be fixed in one of the future product updates.
Resolution
Subscribe to this article to be notified when the bug would be fixed.
Until that, use the following workaround:
-
Install the extension Panel.ini Editor.
-
Go to Extensions > My Extensions > Panel.ini Editor > Open > Editor.
-
Put the desired values for the parameter
disable_functionsas follows and click Save:CONFIG_TEXT: [php]
settings.performance.disable_functions.values[]=base64_decode
settings.performance.disable_functions.default=base64_decode -
Go to Service Plans > plan_name > PHP Settings.
-
Check that the parameter
disable_functionshas the correct value. -
Click Update & Sync.
Warning: So the value of the parameter
disable_functionsis propagated to the domain's PHP Settings, the Hosting performance settings management permission must be disabled in Service Plans > plan_name > Permissions. -
Repeat the steps 5-7 for each service plan.
Additional information
Plesk Onyx Administrator's Guide - Customizing PHP Parameters
Comments
5 comments
OK folks, we need this bug fixed ASAP, as in YESTERDAY! You've managed to turn entire plesk servers into insecure environment, how is this possible?
This is what we were using:
disable_functions = ini_alter,ini_restore,dl,system,exec,passthru,shell_exec,shell,proc_close,proc_open
and this is what we've got now:
disable_functions = "opcache_get_status"
Rubbish!
Hello burnleyvic
Thank you for the feedback.
This issue has an increased priority.
However, the exact ETA is to be available later.
Please, follow this article for updates.
Is there any follow-up or ETA on this topic?
Hello @Webservicesmgmt-lisa
There is no ETA for PPPM-9216 currently. Please use suggested workaround.
This bug is still here in 2021.
It only affects domains with PHP FastCGI. Domains with PHP-FPM respect the global php.ini settings.
If I ran through the recommended solution it would overwrite the PHP handler for half of the domains on the server.
Please sign in to leave a comment.