Warning: ini_set() has been disabled for security reasons

Discussion regarding Joomla! 1.5 security issues.
Joomla! Vulnerable Extensions: http://feeds.joomla.org/JoomlaSecurityV ... Extensions

Moderator: General Support Moderators

Forum rules
Forum Rules
Absolute Beginner's Guide to Joomla! <-- please read before posting, this means YOU.
Security Checklist
Forum Post Assistant - If you are serious about wanting help, you will use this tool to help you post.
User avatar
mandville
Joomla! Master
Joomla! Master
Posts: 15152
Joined: Mon Mar 20, 2006 1:56 am
Location: The Girly Side of Joomla in Sussex

Re: Warning: ini_set() has been disabled for security reason

Post by mandville » Mon Dec 26, 2011 3:54 pm

If your host does not allow you to access or alter the php.ini file then trying to create one will be no good.
php.ini files are normally unique to each setup
HU2HY- Poor questions = Poor answer
Un requested Help PM's will be reported, added to the foe list and possibly just deleted
{VEL Team Leader}{TM Auditor }{ Showcase & Security forums Moderator}

User avatar
PhilD
Joomla! Hero
Joomla! Hero
Posts: 2737
Joined: Sat Oct 21, 2006 10:20 pm
Location: Wisconsin USA
Contact:

Re: Warning: ini_set() has been disabled for security reason

Post by PhilD » Tue Dec 27, 2011 4:45 pm

Which part of the answers are you not understanding?
As has been said before, what you can change is dependent on what your host allows you to change. That is normally a very limited set of options. The specific way these options can be changed is also dependent on the server setup as determined by your host an is server setup specific.

I suggest some reading starting here
http://php.net/manual/en/configuration.changes.php
PhilD

jeganmmk89
Joomla! Apprentice
Joomla! Apprentice
Posts: 7
Joined: Tue Dec 27, 2011 8:56 am
Location: Chennai
Contact:

Re: Warning: ini_set() has been disabled for security reason

Post by jeganmmk89 » Tue Feb 07, 2012 12:45 pm

Definitely hoster's help need for solve this problem...

sgwd
Joomla! Fledgling
Joomla! Fledgling
Posts: 2
Joined: Wed Feb 21, 2007 8:21 pm

Re: Warning: ini_set() has been disabled for security reason

Post by sgwd » Sat Jun 23, 2012 8:59 pm

From my hosting company (this worked perfectly although I did have to set permissions to 600 and add the timezone to all my joomla sites):

This error indicates that ini_set has been disabled globally due to various security issues. How to fix it:

1. Login via FTP then create blank php.ini file inside joomla script folder. For example, if you installed Joomla into root of public_html/joomla folder, create php.ini file there.

2. Inside that file put the following:
disable_functions = show_source, system, shell_exec, passthru, exec, phpinfo, popen, proc_open, allow_url_fopen, ini_alter, proc_terminate, proc_get_status, proc_nice, escapeshell, escapeshellarg, escapeshellcmd, show_source, dl, symlink

3. Save file.

4. Set permissions 400 (chmod 400).

5. Repeat steps for folder "administrator".

NOTE: If you receive "time zone errors" set permissions 600 to php.ini file then add following line:
date.timezone="America/New_York"
Or other time zone you use.

User avatar
mandville
Joomla! Master
Joomla! Master
Posts: 15152
Joined: Mon Mar 20, 2006 1:56 am
Location: The Girly Side of Joomla in Sussex

Re: Warning: ini_set() has been disabled for security reason

Post by mandville » Sun Jun 24, 2012 12:46 am

NOITE: - not all hosts will accept or honour any php.ini files in their setup, please check with your host.
HU2HY- Poor questions = Poor answer
Un requested Help PM's will be reported, added to the foe list and possibly just deleted
{VEL Team Leader}{TM Auditor }{ Showcase & Security forums Moderator}

User avatar
PhilD
Joomla! Hero
Joomla! Hero
Posts: 2737
Joined: Sat Oct 21, 2006 10:20 pm
Location: Wisconsin USA
Contact:

Re: Warning: ini_set() has been disabled for security reason

Post by PhilD » Thu Oct 25, 2012 7:43 pm

Find a better host that knows how to properly setup the server.

Disabling PHP functions is poor practice and won't protect the server.

Disabling ini_set() will break Wordpress, Joomla and many other popular programs.

Commenting out the offending lines in multiple files will break the functionality of Joomla, Wordpress and many other popular programs.
PhilD


Locked

Return to “Security in Joomla! 1.5”