Add a new requirement function to disable dangerous functions by orthagh · Pull Request #23141 · glpi-project/glpi

orthagh · 2026-02-17T10:48:42Z

If someone has an idea to test the thing, please suggest it.
(as the thing can only be enabled in php.ini)

Copilot

Pull request overview

This PR adds a new security requirement class DangerousFunctionsSecurity that checks whether potentially dangerous PHP functions are enabled. The requirement is integrated into both the system requirements manager and the Central dashboard to warn administrators about security risks.

Changes:

Added DangerousFunctionsSecurity requirement class that checks for 33 potentially dangerous PHP functions
Integrated the new requirement into RequirementsManager for system checks
Integrated the new requirement into Central dashboard to display security warnings

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

File	Description
src/Glpi/System/Requirement/DangerousFunctionsSecurity.php	New requirement class that validates dangerous PHP functions are disabled
src/Glpi/System/RequirementsManager.php	Adds DangerousFunctionsSecurity to optional requirements list
src/Central.php	Adds DangerousFunctionsSecurity to security requirements shown in Central dashboard

src/Glpi/System/Requirement/DangerousFunctionsSecurity.php

AdrienClairembault

Looks good:

cedric-anne

Some posix_ functions can be dangerous too.

src/Glpi/System/Requirement/DangerousFunctionsSecurity.php

orthagh · 2026-02-17T14:46:41Z

Some posix_ functions can be dangerous too.

List updated from wordpress recommendations (from a tier party website
Removed pcntl_async_signals, pcntl_signal, pcntl_signal_get_handler, pcntl_signal_dispatch as asked in glpi-project/docker-images#275

AdrienClairembault · 2026-02-17T14:49:27Z

@orthagh
simpler message and enable check for cli

Is it right to enable it for CLI? Some configurations might have a different .ini config for CLI and web.

I think our own docker image allow these methods on the CLI but not on the web (at least this is what I heard last week, unsure if it was merged that way).

orthagh · 2026-02-17T15:35:44Z

Is it right to enable it for CLI? Some configurations might have a different .ini config for CLI and web.

Asked by @cedric-anne in #23141 (comment)

src/Glpi/System/Requirement/DangerousFunctionsSecurity.php

cedric-anne · 2026-02-17T15:35:47Z

src/Glpi/System/Requirement/DangerousFunctionsSecurity.php

+        'pcntl_alarm',
+        'pcntl_fork',
+        'pcntl_waitpid',
+        'pcntl_wait',
+        'pcntl_wifexited',
+        'pcntl_wifstopped',
+        'pcntl_wifsignaled',
+        'pcntl_wifsignaled',
+        'pcntl_wifcontinued',
+        'pcntl_wexitstatus',
+        'pcntl_wtermsig',
+        'pcntl_wstopsig',
+        'pcntl_get_last_error',
+        'pcntl_strerror',
+        'pcntl_sigprocmask',
+        'pcntl_sigwaitinfo',
+        'pcntl_sigtimedwait',
+        'pcntl_exec',
+        'pcntl_getpriority',
+        'pcntl_setpriority',
+        'posix_ctermid',
+        'posix_getcwd',
+        'posix_getegid',
+        'posix_getgid',
+        'posix_getgrgid',
+        'posix_getgrnam',
+        'posix_getgroups',
+        'posix_getlogin',
+        'posix_getpgid',
+        'posix_getpgrp',
+        'posix_getpid',


Maybe it could rely on get_defined_functions() + preg_grep() to get all pcntl/posix functions. It could permit to be sure that no function is forgotten and any new function introduced in the future would be detected.

cedric-anne · 2026-02-17T15:37:18Z

src/Glpi/System/Requirement/DangerousFunctionsSecurity.php

+            }
+        }
+        $this->validation_messages[] = sprintf(
+            __('Functions "%s" are enabled. Please disable them in php.ini (see disable_functions directive) to avoid security risks.'),


It can be disabled either from the php.ini directive or directly in the webserver configuration.

Suggested change

__('Functions "%s" are enabled. Please disable them in php.ini (see disable_functions directive) to avoid security risks.'),

__('Functions "%s" are enabled. You should disable them (see `disable_functions` PHP configuration directive) to avoid security risks.'),

Not sure about this one. It's clearer for people that don't know how to do it and for other we probably don't have to explain

AdrienClairembault · 2026-02-17T15:44:14Z

Is it right to enable it for CLI? Some configurations might have a different .ini config for CLI and web.

Asked by @cedric-anne in #23141 (comment)

I know, just saying that our own docker image might not validate this requirement.

Co-authored-by: Cédric Anne <cedric.anne@gmail.com>

cedric-anne · 2026-02-18T07:49:17Z

Is it right to enable it for CLI? Some configurations might have a different .ini config for CLI and web.

Asked by @cedric-anne in #23141 (comment)

I know, just saying that our own docker image might not validate this requirement.

It is not a problem if our development image does not fit this new requirement in CLI context, as it is optional. Our production docker image will be updated to fit them.

cedric-anne · 2026-02-18T08:49:46Z

proc_open is used when the PHP method is used to send mail. IMHO, We should warn users that disabling proc_open can prevent the PHP native mail function to work and recommand to disable proc_open and switch to the SMTP method.

trasher · 2026-02-18T08:52:07Z

Should we really consider sending mail from sendmail ins unsafe?

cedric-anne · 2026-02-18T08:58:04Z

Should we really consider sending mail from sendmail ins unsafe?

The problem is that it prevents to disable the proc_open function. It means that this function can be used to call any system executable. Thus, it makes it a bit useless to disable exec, shell_exec, paththru, ...

froozeify · 2026-02-18T09:20:54Z

src/Glpi/System/Requirement/DangerousFunctionsSecurity.php

+        'socket_accept',
+        'socket_bind',
+        'socket_clear_error',
+        'socket_close',
+        'socket_connect',
+        'socket_listen',
+        'socket_create_listen',
+        'socket_read',
+        'socket_create_pair',


I'm not sure we should block them.

Socket could be use for example by plugin to interact with a realtime tool.

froozeify · 2026-02-18T14:11:37Z

A new PHPStan rule has been created based on the configuration here.

I've run it locally and our codebase (for glpi 11.x) don't have call to those forbidden tools

glpi-project/phpstan-glpi#16

Copilot AI review requested due to automatic review settings February 17, 2026 10:48

Copilot started reviewing on behalf of orthagh February 17, 2026 10:49 View session

Copilot AI reviewed Feb 17, 2026

View reviewed changes

AdrienClairembault approved these changes Feb 17, 2026

View reviewed changes

cedric-anne reviewed Feb 17, 2026

View reviewed changes

src/Glpi/System/Requirement/DangerousFunctionsSecurity.php Outdated Show resolved Hide resolved

src/Glpi/System/Requirement/DangerousFunctionsSecurity.php Outdated Show resolved Hide resolved

orthagh added 2 commits February 17, 2026 15:35

Add a new requirement function to disable dangerous functions

0a472ae

simpler message and enable check for cli

e4c7fb6

orthagh force-pushed the feat/disablefunction branch from f3fa830 to e4c7fb6 Compare February 17, 2026 14:36

update functions list

bd27cbb

unused import

9e8b882

orthagh added 2 commits February 17, 2026 16:31

allow posix_geteuid (for cron)

eef5e20

remove exec function usage

82cec5a

cedric-anne reviewed Feb 17, 2026

View reviewed changes

Update src/Glpi/System/Requirement/DangerousFunctionsSecurity.php

de13d25

Co-authored-by: Cédric Anne <cedric.anne@gmail.com>

froozeify reviewed Feb 18, 2026

View reviewed changes

froozeify mentioned this pull request Feb 18, 2026

Rule to block dangerous system function glpi-project/phpstan-glpi#16

Open

	__('Functions "%s" are enabled. Please disable them in php.ini (see disable_functions directive) to avoid security risks.'),
	__('Functions "%s" are enabled. You should disable them (see `disable_functions` PHP configuration directive) to avoid security risks.'),

Uh oh!

Conversation

orthagh commented Feb 17, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

AdrienClairembault left a comment

Choose a reason for hiding this comment

Uh oh!

cedric-anne left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

orthagh commented Feb 17, 2026

Uh oh!

AdrienClairembault commented Feb 17, 2026

Uh oh!

orthagh commented Feb 17, 2026

Uh oh!

Uh oh!

cedric-anne Feb 17, 2026

Choose a reason for hiding this comment

Uh oh!

cedric-anne Feb 17, 2026

Choose a reason for hiding this comment

Uh oh!

orthagh Feb 17, 2026

Choose a reason for hiding this comment

Uh oh!

AdrienClairembault commented Feb 17, 2026

Uh oh!

cedric-anne commented Feb 18, 2026

Uh oh!

cedric-anne commented Feb 18, 2026

Uh oh!

trasher commented Feb 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cedric-anne commented Feb 18, 2026

Uh oh!

froozeify Feb 18, 2026

Choose a reason for hiding this comment

Uh oh!

froozeify commented Feb 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

trasher commented Feb 18, 2026 •

edited

Loading