PHP 8.2 php.ini - allow_url_fopen

[kgeary007]

I need to change the settings for
allow_url_fopen = On
I have updated the php.ini using the cPanel editor for our domain. ea-php82

I can see the php.ini file in the joomla root level directory and the top level public_html with the correct setting.

However when I look in Joomla admin at SYSTEM INFORMATION
under CORE it shows php 8.2.22
allow_url_fopen Off Off

How do I update this for Joomla CORE?

[gws]

You need allow url open to be yes! With this off updating and installing extensions may be problematic. This is not a security concern, allow url include is the security risk and often confused with.

[Webdongle]

+1 @gws

https://docs.joomla.org/Security_Checkl ... _url_fopen

Use allow_url_fopen

This option enables the URL-aware fopen wrappers that enable accessing URL object like files. Default wrappers are provided for the access of remote files using the FTP or HTTP protocol, some extensions such as zlib may register additional wrappers. Note: This can only be set in php.ini for security reasons. Enable and use allow_url_fopen to allow Joomla's One-Click-Update to work properly.

For more information see: PHP Manual: allow_url_fopen and allow_url_include

Proper setup will have this:
allow_url_fopen = 1
allow_url_include = 0

PHP default: allow_url_fopen is enabled
PHP default: allow_url_include is disabled

[javiercarpenter]

Sometimes hosting environments use a global php.ini that overrides local settings. You might want to check with your hosting provider to ensure the correct file is being read.

[Webdongle]

@javiercarpenter
There is always a master php.ini, depending on the Hosting package the user may or may not have access to it.

[kgeary007]

I updated the php.ini in the local joomla directory and the top level domain, but I don't have access to the global php.ini
The backend Joomla admin system information / php information shows CORE php 8.2.22

Directive Local Value Master Value
allow_url_fopen Off Off
allow_url_include Off Off

Is there some way I can make Joomla use the local php.ini file instead of the global file?
Is there a setting in htaccess or some other way to modify this?

[gws]

Ask your host to enable it.

[Webdongle]

...

Is there some way I can make Joomla use the local php.ini file instead of the global file?
Is there a setting in htaccess or some other way to modify this?

Nope.
You need to ask your Host. If they refuse to do it and tell you it's a security risk then tell them they don't know what they are talking about and you will change to a Host that does.

[AMurray]

Some quick research (with a grain of salt) indicates allow_url_fopen when used and coded correctly is fine (the risk is in the dodgy coding that might make it a vulnerability)...but allow_url_include is the one to avoid.

[Webdongle]

Hmmmmm yes when allow_url_include is set ON instead of OFF