cvs: php4 / NEWS internal_functions_win32.c main.c php.ini-dist php.ini-optimized

zeev		Mon May 29 10:22:36 2000 EDT

  Modified files:
    /php4	NEWS internal_functions_win32.c main.c php.ini-dist 
         	php.ini-optimized 
  Log:
  - Added disable_functions php.ini support
  - Fixed Win32 build
  
  
Index: php4/NEWS
diff -u php4/NEWS:1.262 php4/NEWS:1.263
--- php4/NEWS:1.262	Sat May 27 09:38:49 2000
+++ php4/NEWS	Mon May 29 10:22:35 2000
@@ -2,13 +2,15 @@
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 
 ?? ??? 2000, Version 4.0.1
+- Added disable_functions php.ini directive, to allow administrators to disable
+  certain functions for security reasons (Zeev)
 - Fixed sessions on Win32. When setting the directory depth parameter in
   save_path you need to now delimit it with a ';' instead of ':', e.g
   "5;/tmp" instead of "5:/tmp" (Andi)
 - Changed the Apache handler's return status to 'Declined' when a requested
   PHP file could not be found.  Returning 'Not Found' caused problems
   in the ErrorDocument handler stage in that $REDIRECT_REDIRECT_ERROR_NOTES
-  was not getting set at all.  Moving to 'Declined' shoudl fix this and I
+  was not getting set at all.  Moving to 'Declined' should fix this and I
   can't see any other side effects.  (Rasmus)
 - Fixed scanning decimal numbers in internationalized environments. They should
   always be in standard US format e.g. 23.3. (Andi, Zend Engine)
Index: php4/internal_functions_win32.c
diff -u php4/internal_functions_win32.c:1.29 php4/internal_functions_win32.c:1.30
--- php4/internal_functions_win32.c:1.29	Thu May 18 08:34:21 2000
+++ php4/internal_functions_win32.c	Mon May 29 10:22:35 2000
@@ -18,7 +18,7 @@
  */
 
 
-/* $Id: internal_functions_win32.c,v 1.29 2000/05/18 15:34:21 zeev Exp $ */
+/* $Id: internal_functions_win32.c,v 1.30 2000/05/29 17:22:35 zeev Exp $ */
 
 
 #include "php.h"
@@ -43,7 +43,7 @@
 #include "ext/standard/php_dir.h"
 #include "ext/standard/php_filestat.h"
 #include "ext/standard/php_mail.h"
-#include "ext/standard/php_syslog.h"
+#include "ext/standard/php_ext_syslog.h"
 #include "ext/standard/php_standard.h"
 #include "ext/standard/php_lcg.h"
 #include "ext/standard/php_output.h"
Index: php4/main.c
diff -u php4/main.c:1.255 php4/main.c:1.256
--- php4/main.c:1.255	Sun May 28 10:19:49 2000
+++ php4/main.c	Mon May 29 10:22:35 2000
@@ -19,7 +19,7 @@
 */
 
 
-/* $Id: main.c,v 1.255 2000/05/28 17:19:49 andi Exp $ */
+/* $Id: main.c,v 1.256 2000/05/29 17:22:35 zeev Exp $ */
 
 
 #include <stdio.h>
@@ -148,6 +148,22 @@
 }
 
 
+static PHP_INI_MH(OnDisableFunctions)
+{
+	char *func;
+	char *new_value_dup = zend_strndup(new_value, new_value_length);	/* This is an intentional leak,
+																		 * it's not a big deal as it's process-wide
+																		 */
+
+	func = strtok(new_value_dup, ", ");
+	while (func) {
+		zend_disable_function(func, strlen(func));
+		func = strtok(NULL, ", ");
+	}
+	return SUCCESS;
+}
+
+
 /* Need to convert to strings and make use of:
  * DEFAULT_SHORT_OPEN_TAG
  * PHP_SAFE_MODE
@@ -232,6 +248,8 @@
 	PHP_INI_ENTRY("precision",					"14",		PHP_INI_ALL,		OnSetPrecision)
 	PHP_INI_ENTRY("sendmail_from",				NULL,		PHP_INI_ALL,		NULL)
 	PHP_INI_ENTRY("sendmail_path",	DEFAULT_SENDMAIL_PATH,	PHP_INI_SYSTEM,		NULL)
+
+	PHP_INI_ENTRY("disable_functions",			"",			PHP_INI_SYSTEM,		OnDisableFunctions)
 PHP_INI_END()
 
 
Index: php4/php.ini-dist
diff -u php4/php.ini-dist:1.35 php4/php.ini-dist:1.36
--- php4/php.ini-dist:1.35	Wed May 10 02:31:53 2000
+++ php4/php.ini-dist	Mon May 29 10:22:35 2000
@@ -105,6 +105,14 @@
 													; even if safe_mode_allowed_env_vars is
 													; set to allow to change them.
 
+
+disable_functions	=								; This directive allows you to disable certain
+													; functions for security reasons.  It receives
+													; a comma separated list of function names.
+													; This directive is *NOT* affected by whether
+													; Safe Mode is turned on or off.
+													
+
 ; Colors for Syntax Highlighting mode.  Anything that's acceptable in <font color=???> would work.
 highlight.string	=	#DD0000
 highlight.comment	=	#FF8000
Index: php4/php.ini-optimized
diff -u php4/php.ini-optimized:1.4 php4/php.ini-optimized:1.5
--- php4/php.ini-optimized:1.4	Wed May 10 02:31:53 2000
+++ php4/php.ini-optimized	Mon May 29 10:22:35 2000
@@ -93,6 +93,14 @@
 													; even if safe_mode_allowed_env_vars is
 													; set to allow to change them.
 
+
+disable_functions	=								; This directive allows you to disable certain
+													; functions for security reasons.  It receives
+													; a comma separated list of function names.
+													; This directive is *NOT* affected by whether
+													; Safe Mode is turned on or off.
+
+
 ; Colors for Syntax Highlighting mode.  Anything that's acceptable in <font color=???> would work.
 highlight.string	=	#DD0000
 highlight.comment	=	#FF8000