phpconfigcheck.php

<?php
/*
[+] PHP Secure Configuration Checker - (c) 2014 - SektionEins GmbH
    -- Ben Fuhrmannek <ben.fuhrmannek@sektioneins.de>

[+] Description:
    Check current PHP configuration for potential security flaws.
    Simply access this file from your webserver or run on CLI.

[+] Idea:
    * one single file for easy distribution
    * simple tests for each security related ini entry
    * a few other tests - not too complicated though
    * compatible with PHP >= 8.1
    * NO complicated/overengineered code, e.g. no classes/interfaces,
      test-frameworks, libraries, ...
        -> It is supposed to be obvious on first glance - even for novices -
           how this tool works and what it does!
    * NO (or very few) dependencies

[+] WARNING:
    This tool will only support you setting up a secure PHP environment.
    Nothing else. Your setup, software or any related configuration may still
    be vulnerable, even if this tool's output suggests otherwise.

[+] Update:
    Please check https://github.com/sektioneins/pcc

[+] License:
    This tool is licensed under the New BSD License.
    See LICENSE file for fulltext version of the license.

[+] Copyright Notes:
    Some text fragments were copied from the printed PHP Web Security
    Poster with permission. - (C) 2009 SektionEins GmbH
    - Concept: Stefan Esser, fukami, Ben Fuhrmannek

*/

/*****************************************************************************/
/* *** *** *** DANGER ZONE!! *** *** *** */

// uncomment to disable IP restrictions by default
// WARNING: better keep access restricted, e.g. set PCC_ALLOW_IP=10.0.0.*
//putenv("PCC_ALLOW_IP=*");

// This script will deactivate after 48 hours automatically.
// To disable this feature, uncomment the line below.
// WARNING: better keep this commented out unless further restrictions apply, e.g. IP check
//putenv("PCC_DISABLE_MTIME=1");

/*****************************************************************************/

$pcc_name = "PHP Secure Configuration Checker";
$pcc_version = "0.3.0";
$pcc_copy = "(c) 2014-2026 SektionEins GmbH / Ben Fuhrmannek";
$pcc_date = "2026-02-24"; // release date for update check
$pcc_url = "https://github.com/sektioneins/pcc"; // download URL

/*****************************************************************************/
PHP_VERSION_ID >= 80100 || die("This version of PCC requires at least PHP 8.1. Please update PHP or check out an older version of PCC -> $pcc_url\n");

/*****************************************************************************/

// test result codes
define("TEST_CRITICAL", "critical"); // critical problem found.
define("TEST_HIGH", "high"); // high problem found.
define("TEST_MEDIUM", "medium"); // medium. this may be a problem.
define("TEST_LOW", "low"); // low. boring problem found.
define("TEST_MAYBE", "maybe"); // potential security risk. please check manually.
define("TEST_COMMENT", "comment"); // odd, but still worth mentioning.
define("TEST_OK", "ok"); // everything is fine. move along.
define("TEST_SKIPPED", "skipped"); // probably not applicable here.
define("TEST_UNKNOWN", "unknown"); // something is unknown.

//bash color codes
define("ANSI_COLOR_critical", "0;31"); //red
define("ANSI_COLOR_high", "1;31"); //light red
define("ANSI_COLOR_medium", "1;33"); //yellow
define("ANSI_COLOR_low", "1;32"); //light green
define("ANSI_COLOR_maybe", "0;36"); //cyan
define("ANSI_COLOR_comment", "1;36"); //light cyan
define("ANSI_COLOR_ok", "0;32"); //green
define("ANSI_COLOR_skipped", "0;37"); //gray
define("ANSI_COLOR_unknown", "1;37"); //dark gray

// globals
$cfg = [	'output_type' => 'text',
				'allowed_output_types' => ['text', 'html'],
				'showall' => 0,
				'result_codes_default' => [TEST_CRITICAL, TEST_HIGH, TEST_MEDIUM, TEST_LOW, TEST_MAYBE, TEST_COMMENT],
				'need_update' => 0];
if (function_exists('json_encode')) {
	$cfg['allowed_output_types'][] = 'json';
}
$all_result_codes = [TEST_CRITICAL, TEST_HIGH, TEST_MEDIUM, TEST_LOW, TEST_MAYBE, TEST_COMMENT, TEST_OK, TEST_SKIPPED, TEST_UNKNOWN];
$trbs = []; // test result by severity, e.g. $trbs[TEST_OK][...]
foreach ($all_result_codes as $v) { $trbs[$v] = []; }
$cfg['s1_logo'] = "data:image/gif;base64,R0lGODlhCwFLAOYAAAMlTWV6ku7w8+rt8M7V3LnCzvX2+Nzh5vHz9e/x9NHX32yAmJKhsjVQcEhhfq24xcrR2k5mgr3G0Nne5Bs5XqGuvZ2quiVCZam0wjBMbdXb4ens7+3v8oGSplJphePn6y1Ja97i6IqarOTo7LS+yrO9yWh8lMbO1zpUdCpGaQ4uVYSUqAkqUcLK1KSwv7bAzJaktXyNo3eJn8DI04aWqmp+lpimtkFaeWF2jxY1W3SHnaaywF1zjThTc3GEmyA+Yo6dr3qMoTxWdUVefFpwixAwVh07X3mLoFhuiVZtiBIyWD5Yd/7+/v39/vz8/QssU/v8/ODk6eHl6vj5+r/I0vn6+1Vsh/r7+/f4+ZSis8TM1VBng3+QpTRPcIybrl90jn6PpAYnT8XN1vP19xQzWefq7tPZ4MjP2Bg3XObp7au2xJuouAwsU9fc40NceszT22N4ka+6x4+esHCDmpCfsbvEz9jd4ydEZ5+su6y3xIiYq7G7yHOGnEtjgAAiS////yH5BAAAAAAALAAAAAALAUsAAAf/gH+Cg4SFhoeIiYqLjI2Oj5CRkpOUlZaXmJmam5ydnp+goaKjpKWmp6ipqqusra6vsLGys6lQWAhjublYTodMNn0lCbTExcaaTRwTMxYxREMO0Q59ASsYJyFjTYIbbn4AQi4cx+Tl5oYjVCsRRn7u7/DwKXAWVX8tLPARe1jn/v+xToi4oSSewYN+HFSBssIgGxMTAEqcWEpMjXYIM8Kz8YeDEIQZ9lAcSTLThDk/NKp0R6HNnxIAMpLRs62kzZuLmthIsbKnBwN/tGTQGGbOFJxIk/4JkSRfTxUUjEg1ksOpOwtM/kAp46JHRgABxigdO1ICCJVhjFiJgYeKnRBw/0OYeQFjjpA7EQkJqMDzIAAT/cgKNsekQkGEAJREwDDB3qIEIa4c+mDCarwFkgdrJlb4ScYLcxRwskDBL53NqGWtsQwvxwINnyT0jafkRerbrCp4PiiEhKgTdw6CkIK7uCkJOfyaID5KzGx4JqAYnw4qxFCDKugEJiWhdLwitqmL3/TloAqsqGDs1jduvPtKq7GvqXnqSvl4ACq83x+pzXV4ANBAHyoHPOdOHwPwp2BORxwUwHaqMBCGOwDk4EEB0i2ooSFvXGBQAyG4ggAKKqQQAwEbpljIFQ3G80QcsBRQwQcq1jjIBCnFg4ONPMrCxBoGUQDbLArYgGKPCgowhP9BC8xCxQJ3hBEEkgq+UUQ8KpwAyxRqOIDGO24kSKV7Tshh0BC9vCLFf+7kUAAsTWzwAYRjkoLFffCsEUsTSBgkQiRQJJDGCBtgkdUlCXiQggQlMdEEE5BGKimkE5XRRTxh5AWLBax94RgjYxTAhxAUoHGBBwzYcQkHPbAgkiVMCCBWKghgIAcDuOaqKwN0DCnIGAIcagwEV8JzAwKyQPAlPELQyEgIOFCYAwW7ZRAHnZB49EQJsGrRBxwHpHLAWStlMQhlDkggLDEkGORDZrCMGA8FbzCywRJ+hLFFFlSc4UIAxeZRibbcVjJFAO4wkEoUKPhx6hYRRCyxxFQMYoP/O0QAZczF8WSx7isR4PemIk504EcRQMAriAVGZFAxJQQ30gQCBnwMBQxK/OAbKlF4BYajUAQtdNBXCCvBHU/Q8CkxLcKDAS0LxATPDosIkFIAiGih6SQxMzJBBDIgW4gBBYihcik9+7ECJBDs0Z4x0cJTxAy0dCD1O3gsYgcLRRTsSdeLaOFHChvMkjYXH9uEZ5sQ0GLDhPAIqIgCLBih5SeAK3KCH12IGcvhiZcU9zs5nEHLA6zFkCEiGvCtBiVOTLF0IZknAoEfDQhAyRWyQ9KE7KH/ATonTFRRxYCHxD47JqO3afosO6R+diEJeJgEtopAoQANEWTQAA4WOEtI/+2h5vFAAhDQoEcNflDABRAr0BDuH1KIUIHYhZTxwAIoZNADHBVgDiGYoIUYiOEPH8iCBzLQBSSIwxDDawQC8EAD8f1hBjJAkRQssMAMEGEHbyNECIDgAO99QQ0htMTi/FA6WogAcu8wV/YaAoAFSCF41OuACvygAjQoISZd2MOAMjeGBgHAA2OgQUYeIIg6+CEDAhSEE0pwHSVQ4Id+uEMFIASFGPihAwq41BPQkBw/RCBEhEjb2hxhHT/QTRBMkMEXFdAAHqKBDO7YggWZ0AKesCAHh4mAryxhgniwYGSyiMHd3OECRpTBAe64gB5O4LlDjAFhRYDDAyaghRUMpf8IrxIE4ASwAD+wQHV/kMACFpAEFpqAD6scEhUA0IARDNAG+chAB6gQghkA4SN+iMGnnMAFP/QhBSz4oAYgEITkmOAog0gbEV5QgBdY85ovIMEBhCWFS2lhEEzwohuMwAIePKANJ5CBM7djB570wAIK0IIMCnID3V1CDwZp5Cya5w4YMSINJlgWACIQgwLYkxBOoIMfjMBEQnzAA4NDY0eEsC1BDIAIPKTDx8zghx4sb5a1JIQWdsiDwhHCADIIQxgqUBMnNCRfCiMEDMJAhssJgmErWcDquumHbw5CBO5gAUdkyjfRCOJiIJifIPAAAh2kARMuMIgXkNcKKCwJHiz/8GkjCrAAr7hDMX4TRAjIqSd0DGWqohQCC7gVAogaQT+G2FwDKikIkNpSEE2AZB/wh9BCZkB8eHCHDz62Aa8M9aYNS4EVkmCFxjq2sTtIE/28SQiOTYl2XtEnExpigkI0QQOrs8QMYIgxjcEiBAa6gFEfEYU4HKEvZKDD6irgBw8kIqoOaI9HVCCGESzpAogshFzp+ge7DoIAJ2MUIsyQkqcJIg9+QEPjPIswGggrbR2Q3RS2y90p8IIQPNXqH7LgBzIcqRCFFEFNGOAwm3YCR/EwAnFZUYJivWMIJpXEBOiQEjaMrAns+4IESEDgApOgAA25ABo9ooQYQLIH0z3E/3ANYVxBKHQJ2JNieVD5Bwwk5KCE8OIKruuVNTYivIQgrxDuWggd+EG9giBASi7gAwy8YRibQAAk46FcWHBhkX7QAVUfwQQSJGcBR4ECJPlWhCY7ucn5MEJeOHADAHgmDHXQHO6IW+E/lHJHigCDH3AQGA+D2RDFtG40vYI4R6B4EOTN2CF88OKaNKEA5OohCmpwwExcwcWXicUYgPkOAOjTEi52w1OhcIMnEoGxj21sErawAJMyeAFnGYJE47plCtOSxew7MyJMRoRZmRkRYlbzTdmMw0K8WRDkrcGQ6QzjQQxgDzwAQbGKIIdWP0INQL7AfFMhgWW9IwWrrURgU/8QESeUpwNMcIK0py3tJjiBPh5hwwzOkJIeJJsQEy5ElxsyhOURgn0ycMypD5FqEvuhzSemLJz9YALJEoLWVG3CFczAAK9QwJ+XiEJw4BGGw7KCCYWMx08wcbEMhIsJQPCDG6aHiJi9ICUpcO8gwk2ILhdgod92aB3R0+Exo9oPqhYeq90sb1jT296DwLciJnAWrGECC3MwyBKgyQoZY8rgiRgDCWwA819BNAliIwALlOBcQxBgBtvpWgFmrPE/iAF3KSzupwdhAJ6YIHheaJ+v1m2Idq/53b4exKvH+/I51/lXZqATFEoZAU1IgDVhyBsrrlDKeDC7EXKYEBBg3oT/FcREhn8wgF/POwgIZOAJiAQcFYYC3EJcHQT5HUSX/7ADPzyBDkV3QXLAwHOyF8Lsq37xI9ZO3nq7HcYI0MEFTuPQofBBEwnog0FAYEFUzACP8ehsI1ywwzAEgARSGMAH6rCACeGXEBMITgpsoIEBlIEAcgjODyKsrZ3FeChoeN0gDsACNnRgA2UoQBTquvVBTKHvx4+CoDDomQhU0vSEQL3wGjYEL/j//wAoAhagdi33BzDQdoYgc/fiBw0mBmUwAFRgBX6wfZvgAuvxDjqwCrlnEDnAeIuwB9dRBA2wBD1QRg5gBnF1VReAAj2QI27QAoQwAGchfsc1FE/AAIHB/3ff0AMN8ATO9XEpEEV/gAAxwAamlAFC0AB4BAA10HtRRQSI4GI/M37kohIAMAio5Qc99gdAhQMUBwdflCYEsGMU0AM9gEc5AFeaMABXJTcCgwouBWR+YHOPMAFAcAMwBABuQAeZRwgbwEHtAABG4AFr8FSEgAAykAQRdlw44AY8oCrcIAMewgJDYFRm4AE6kHVOQAUy0APFlwE1UALYogU3EFOGsAM3QIN/MAAy0AcesAWwGIuyGAFnNgA64AGDRAIOQHSHsAYOEAf0sQE2YAUpAQB3YAISMGSWgAH2dWweOApxcIHu8ANb4whxQgASUAB1AAHDRggJcAAEQAATgP9jhcAEY5AAoTUIY8ABA2Baf1AFIQABCjAANREoCKCMVVAGGvAGBJAGGXYF7YgIWDAAENIE65gACJmQComQ+DMzCWBvVcAB7kgIWMABPDcI3xiOUTCRmuAEPHAQbrB+pXAGGAEgf1InG6IBBnIgQvgJCsAm7+AAfIWSCmKBB+EAm+YJWlCFrRFyNMkfgGYQPfA8ndAELuAdhtR0P6khYwBRB/EDa3CRmLABMcAaFNIByriU7zECO2YQAMADz0gJe9CGBmEC5qaV/DECuocQFyADKFgJdWACh3EQOECOaJkiH7CWbGkCM5B2FIkBHmBsXjkHdnmXKTICH6kRZIACBXWoALNiCAPQBnGwACmwQxkRBiuQYYa5IAawAs3oFyzwA27wBXygAx0QAzowB0lQglZpED8QWZtJJQXQAHLYE7ZpSh7gErE5JgNwBCV5m7aZAVmQlbtZIydgAjkCnBqRAjKQk8VZJ2JAmcppEGHQAzSgm8+JlgQAA0mQAqS1EmzQAAGAAc6ZnVqZABqAAR3AAw2AlADyA0KAAyJQAgegmeZ5n/iZn/qplYEAADs=";
$cfg['s1_logo_aa'] = "
            `.-:///:-.` /+-`
        `/shmmmmmmmmmm:.dmmds:
     `/ymmmdyo/::-:://  `:sdmmh:
    /hmmdo-                `+dmmy.
  `smmd/`                    .ymmh`
 `hmmy.                        /-`
 ymmy`                        -oyy
-mmm-                         .dmm:    ---   $pcc_name
+mmh                           ymmo    ---   Version $pcc_version
ommh                           ymms    ---   $pcc_copy
:mmd.                         `dmm/    ---- https://sektioneins.de/
`hmms                         +mmd`
 -dmmo                       +mmd:
  -dmmy.                   .smmd:
   `smmms-               -sdmmy.
     -sdmmds+:.``  `.-/sdmmms-
       `/sdmmmmmdddmmmmmds/`
           .:/ossssso+:.            ";

/*****************************************************************************/


// are we running as cli?
if (php_sapi_name() == "cli") {
	$cfg['output_type'] = "text";
	$cfg['is_cli'] = true;

	if (function_exists('getopt')) {
		foreach (getopt("hja") as $k => $v) {
			switch ($k) {
				case 'h':
					$cfg['output_type'] = 'html';
					break;
				case 'j':
					if (!in_array('json', $cfg['allowed_output_types'])) {
						die("json output not supported");
					}
					$cfg['output_type'] = 'json';
					break;
				case 'a':
					$cfg['showall'] = 1;
					break;
			}
		}
	}
} else {
	$cfg['output_type'] = "html";
	$cfg['is_cli'] = false;

	// mtime check
	$cfg['PCC_DISABLE_MTIME'] = getenv("PCC_DISABLE_MTIME");
	$cfg['SCRIPT_FILENAME'] = getenv("SCRIPT_FILENAME");
	if (!$cfg['PCC_DISABLE_MTIME'] && $cfg['SCRIPT_FILENAME'] !== FALSE) {
		if (filemtime($cfg['SCRIPT_FILENAME']) + 2*24*3600 < time()) {
			die("mtime check failed. - For security reasons this script was disabled automatically after a while.\n Please 'touch' me, or set the environment variable 'PCC_DISABLE_MTIME=1' (e.g. 'SetEnv PCC_DISABLE_MTIME 1' for apache/.htaccess)");
		}
	}

	// IP check
	$cfg['REMOTE_ADDR'] = getenv("REMOTE_ADDR");
	$cfg['PCC_ALLOW_IP'] = getenv("PCC_ALLOW_IP");
	if ($cfg['REMOTE_ADDR'] !== FALSE) {
		if (!in_array($cfg['REMOTE_ADDR'], ["127.0.0.1", "::1"], TRUE)
			&& !($cfg['PCC_ALLOW_IP'] !== FALSE && fnmatch($cfg['PCC_ALLOW_IP'], $cfg['REMOTE_ADDR']))) {
			die("Access denied. - Your IP is not cleared. Please set PCC_ALLOW_IP to your IP address or a wildcard pattern, e.g. 'SetEnv PCC_ALLOW_IP 10.0.0.*'");
		}
	}

	// output type
	if (isset($_GET['format']) && in_array($_GET['format'], $cfg['allowed_output_types'], true)) {
		$cfg['output_type'] = $_GET['format'];
	} elseif (in_array(getenv('PCC_OUTPUT_TYPE'), $cfg['allowed_output_types'], true)) {
		$cfg['output_type'] = getenv('PCC_OUTPUT_TYPE');
	}

	switch ($cfg['output_type']) {
		case 'text':
			header("Content-Type: text/plain; charset=utf-8");
			break;
		case 'json':
			header("Content-Type: application/json; charset=utf-8");
			break;
		case 'html':
			header("Content-Type: text/html; charset=utf-8");
			break;
	}

	// do not hide unknown/skipped/ok tests
	if (isset($_GET['showall']) && $_GET['showall'] === "1") {
		$cfg['showall'] = 1;
	}
}

// detect OS
$cfg['is_win'] = strtoupper(substr(PHP_OS, 0, 3)) === 'WIN';

// detect CGI
$cfg['is_cgi'] = (substr(php_sapi_name(), 0, 3) === 'cgi');

/*****************************************************************************/


// functions
function tdesc($name, $desc=NULL) {
	return [
		"name" => $name,
		"desc" => $desc,
		"result" => NULL,
		"reason" => NULL,
		"recommendation" => NULL
	];
}

function tres($meta, $result, $reason=NULL, $recommendation=NULL) {
	global $trbs;
	$res = array_merge($meta, ["result" => $result, "reason" => $reason, "recommendation" => $recommendation]);
	$trbs[$result][] = $res;
}

function ini_atol($val)
{
	$ret = intval($val);
	$val = strtolower((string)$val);
	switch (substr($val, -1)) {
		case 'g': $ret *= 1024; // fall through
		case 'm': $ret *= 1024; // fall through
		case 'k': $ret *= 1024;
	}
	return $ret;
}

function ini_list($val)
{
	if ($val == "") {
		return NULL;
	}
	$ret = preg_split('/[, ]+/', $val);
	if (count($ret) == 1 && $ret[0] == "") {
		return NULL;
	}
	return $ret;
}

function is_writable_or_chmodable($fn)
{
	if (!extension_loaded("posix")) { return is_writable($fn); }
	$stat = stat($fn);
	if (!$stat) { return false; }
	$myuid = posix_getuid();
	$mygids = posix_getgroups();
	if ($myuid == 0 ||
			$myuid == $stat['uid'] ||
			(in_array($stat['gid'], $mygids) && ($stat['mode'] & 0020)) ||
			($stat['mode'] & 0002)) {
		return true;
	}
	return false;
}

function is_on($v)
{
	if ($v == "0"  || $v === "" || strtolower($v) == "off") { return 0; }
	return 1;
}

/*****************************************************************************/

function test_all_ini_entries()
{
	global $cfg;
	$helptext = [
		"display_errors" => "Error messages can divulge information about the inner workings of an application and may include private information such as Session-ID, personal data, database structures, source code exerpts. It is recommended to log errors, but not to display them on live systems.",
		'log_errors' => "While it may be a good idea to avoid logging altogether from a privacy point of view, monitoring the error log of an application can lead to detecting attacks, programming and configuration errors.",
		'expose_php' => "Knowing the exact PHP version - sometimes including patchlevel and operating system - is a good start for automated attack tools. Best not to share this information.",
		'max_execution_time' => "In order to prevent denial-of-service attacks where an attacker tries to keep your server's CPU busy, this value should be set to the lowest possible value, e.g. 30 (seconds).",
		'max_input_time' => "It may be useful to limit the time a script is allowed to parse input. This should be decided on a per application basis.",
		'max_input_nesting_level' => "Deep input nesting is only required in rare cases and may trigger unexpected ressource limits.",
		'memory_limit' => "A high memory limit may easily lead to resource exhaustion and thus make your application vulnerable to denial-of-service attacks. This value should be set approximately 20% above an empirically gathered maximum memory requirement.",
		'post_max_size' => "Setting the maximum allowed POST size to a high value may lead to denial-of-service from memory exhaustion. If your application does not need huge file uploads, consider setting this option to a lower value. Note: File uploads have to be covered by this setting as well.",
		'post_max_size>memory_limit' => "post_max_size must be lower than memory_limit. Otherwise, a simple POST request will let PHP reach the configured memory limit and stop execution. Apart from denial-of-service an attacker may try to split a transaction, e.g. let PHP execute only a part of a program.",
		'upload_max_filesize' => "This value should match the file size actually required.",
		'max_file_uploads' => "This value should match the maximum number of simultaneous file uploads. (lower is better)",
		'allow_url_fopen' => "Deactivate, if possible. Allowing URLs in fopen() can be a suprising side-effect for unexperienced developers. Even if deactivated, it is still possible to receive content from URLs, e.g. with curl.",
		'allow_url_include' => "This flag should remain deactivated for security reasons.",
		'enable_dl' => "Deactivate this option to prevent arbitrary code to be loaded during runtime (see dl()).",
		'disable_functions' => "Potentially dangerous and unused functions should be deactivated, e.g. system().",
		'disable_classes' => "Potentially dangerous and unused classes should be deactivated.",
		'request_order' => "It is recommended to use GP to register GET and POST with REQUEST.",
		'variables_order' => "Changing this setting is usually not necessary; however, the ENV variables are rarely used.",
		'auto_globals_jit' => "Unless access to these variables is done through variable variables this option can remain activated.",
		'file_uploads' => "If an application does not require HTTP file uploads, this setting should be deactivated.",
		'filter.default' => "This should only be set if the application is specifically designed to handle filtered values. Usually it is considered bad practice to filter all user input in one place. Instead, each user input should be validated and then escaped/encoded according to its context.",
		'open_basedir' => "Usually it is a good idea to restrict file system access to directories related to the application, e.g. the document root.",
		'session.save_path' => "This path should be set to a directory unique to your application, but outside the document root, e.g. /opt/php_sessions/application_1. If this application is the only application on your server, or a custom storage mechanism for sessions has been implemented, or you don't need sessions at all, then the default should be fine.",
		'session.cookie_httponly' => "This option controls if cookies are tagged with httpOnly which makes them accessible by HTTP only and not by the JavaScript. httpOnly cookies are supported by all major browser vendors and therefore can be instrumental in minimising the danger of session hijacking. It should either be activated here or in your application with session_set_cookie_params().",
		'session.cookie_secure' => "This option controls if cookies are tagged as secure and should therefore be sent over SSL encrypted connections only. It should either be activated here or in your application with session_set_cookie_params().",
		'session.cookie_lifetime' => "Not limiting the cookie lifetime increases the chance for an attacker to be able to steal the session cookie. Depending on your application, this should be set to a reasonable value here or with session_set_cookie_params().",
		'session.cookie_samesite' => "Set SameSite to `Lax` or `Strict` to better protect against CSRF.",
		'session.referer_check' => "PHP can invalidate a session ID if the submitted HTTP Referer does not contain a configured substring. The Referer can be set by a custom client/browser or plugins (e.g. Flash, Java). However it may prevent some cases of CSRF attacks, where the attacker can not control the client's Referer.",
		'session.use_strict_mode' => "If activated, PHP will regenerate unknown session IDs. This effectively counteracts session fixation attacks.",
		'session.use_cookies' => "If activated, PHP will store the session ID in a cookie on the client side. This is recommended.",
		'session.use_only_cookies' => "PHP will send the session ID only via cookie to the client, not e.g. in the URL. Please activate.",
		'session.name' => "Your session name is boring. Why not change it to something more suitable for your application?",
		'session.use_trans_sid' => "Allowing the user to choose to store the session ID within the URL makes session hijacking a realistic security risk. URLs are logged in logfiles and can easily be copied by the user or by scripts. This option must be disabled.",
		'session.sid_length' => "Short session IDs increase the risk of session hijacking via brute-force. Set session.sid_length to at least 32 (the default). Higher values like 48 or 64 provide even better protection.",
		'session.sid_bits_per_character' => "Set session.sid_bits_per_character to at least 5 (or 6) for better entropy density per character in session IDs.",
		'serialize_precision' => "Setting serialize_precision=-1 is recommended for PHP 8.x to avoid floating-point precision issues with json_encode() and serialize(). This ensures numbers are encoded with full precision without spurious extra digits.",
		'session.serialize_handler' => "The 'php' serialize handler is vulnerable to injection when session keys contain the pipe character. Use 'php_serialize' instead.",
		'session.gc_maxlifetime' => "Long session lifetimes increase the window for session hijacking. Consider reducing session.gc_maxlifetime.",
		'unserialize_max_depth' => "Setting unserialize_max_depth to 0 disables depth checking, making your application vulnerable to deserialization bombs. The default value of 4096 is recommended.",
		'zend.exception_ignore_args' => "In production, set zend.exception_ignore_args=1 to prevent stack traces from exposing sensitive function arguments such as passwords, tokens, or database queries.",
		'zend.exception_string_param_max_len' => "Set zend.exception_string_param_max_len=0 in production to prevent stack traces from showing string parameter values.",
		'sqlite3.defensive' => "SQLite3 defensive mode prevents certain dangerous operations. Enable it to prevent abuse via user-supplied SQL queries.",
		'sqlite3.extension_dir' => "An attacker may try to place a malicious SQLite3 extension in this directory. It should not be writable.",
		'max_multipart_body_parts' => "An unlimited number of multipart body parts can be exploited for denial-of-service attacks. Set max_multipart_body_parts to a reasonable value, e.g. 1000.",
		'openssl.cafile' => "If openssl.cafile is configured but the path does not exist, TLS certificate verification may silently fail, exposing connections to man-in-the-middle attacks.",
		'openssl.capath' => "If openssl.capath is configured but the path does not exist, TLS certificate verification may silently fail, exposing connections to man-in-the-middle attacks.",
		'arg_separator' => "The usual argument separator for parsing a query string is '&'. Standard libraries handling URLs will possibly not be compatible with custom separators, which may lead to unexpected behaviour. Also, additional parsers - such as a WAF or logfile analyzers - have to be configured accordingly.",
		'assert.active' => "assert() evaluates code just like eval(). Unless it is actually required in a live environment, which is almost certainly not the case, this feature should be deactivated.",
		'assert.callback' => "Failed assertions call a user function. This can be useful for test environments, but most certainly should not be used in production. An attacker may try to override this value to call a different function. If possible, deactivate assert altogether.",
		'zend.assertions' => "assert() in able to evaluate code. Please deactivate this feature for production environments by setting zend.assertions=-1.",
		'auto_append_file' => "PHP is automatically executing an extra script for each request. An attacker may have planted it there. If this is unexpected, deactivate.",
		'cli.pager' => "PHP executes an extra script to process CLI output. An attacker may have planted it there. If this is unexpected, deactivate.",
		'cli.prompt' => "An overlong CLI prompt may indicate incorrect configuration. Please check manually.",
		'curl.cainfo' => "Incorrect configuration of this option may prevent cURL from validating a certificate.",
		'docref_*' => "This setting may reveal internal ressources, e.g. internal server names. Setting docref_root or docref_ext implies HTML output of error messages, which is bad practice for live environments and may reveal useful information to an attacker as well.",
		'default_charset=empty' => "Not setting the default charset can make your application vulnerable to injection attacks based on incorrect interpretation of your data's character encoding. If unsure, set this to 'UTF-8'. HTML output should contain the same value, e.g. <meta charset=\"utf-8\"/>. Also, your webserver can be configured accordingly, e.g. 'AddDefaultCharset UTF-8' for Apache2.",
		'default_charset=typo' => "Change this to 'UTF-8' immediately.",
		'default_charset=iso-8859' => "There is nothing wrong with ISO8859 charsets. However, the hipster way to deliver content tries not to discriminate and allows multibyte characters, e.g. Klingon unicode characters, too. Some browsers may even be so bold as to use a multibyte encoding anyway, regardless of this setting.",
		'default_charset=custom' => "A custom charset is perfectly fine as long as your entire chain of character encoding knows about this. E.g. the application, database connections, PHP, the webserver, ... all have the same encoding or know how to convert appropriately. In particular calls to escaping functions such as htmlentities() and htmlspecialchars() must be called with the correct encoding.",
		'default_mimetype' => "Please set a default mime type, e.g. 'text/html' or 'text/plain'. The mime type should always reflect the actual content. But it is a good idea to define a fallback here anyway. An incorrectly stated mime type can lead to injection attacks, e.g. using 'text/html' with JSON data may lead to XSS.",
		'default_socket_timeout' => "By delaying the process to establish a socket connection, an attacker may be able to do a denial-of-service (DoS) attack. Please set this value to a reasonably small value for your environment, e.g. 10.",
		'doc_root=empty' => "The PHP documentation strongly recommends to set this value when using CGI and cgi.force_redirect is off.",
		'error_append_string' => "PHP adds additional output to error messages. If planted by an attacker, this string may contain script content and lead to XSS. Please check.",
		'error_reporting' => "PHP error reporting can provide useful information about misconfiguration and programming errors, as well as possible attacks. Please consider setting this value.",
		'extension_dir' => "An attacker may try to leave a PHP extension in the extensions directory. This directory should not be writable and the web user must not be able to change file permissions",
		'exit_on_timeout' => "In Apache 1 mod_php may run into an 'inconsistent state', which is always bad. If possible, turn this feature on.",
		'filter.default' => "Using a default filter or sanitizer for all PHP input is generally not considered good practice. Instead, each input should be handled by the application individually, e.g. validated, sanitized, filtered, then escaped or encoded. The default value is 'unsafe_raw'.",
		'highlight.*' => "Your color value is suspicious. An attacker may have managed to inject something here. Please check manually.",
		'iconv.internal_encoding!=empty' => "Starting with PHP 5.6 this value is derived from 'default_charset' and can safely be left empty.",
		'ldap.max_links' => "In order to prevent denial-of-service attacks this option should be set to the lowest number possible. If LDAP is not needed at all, the LDAP extension should not be loaded in the first place.",
		'log_errors_max_len' => "An attacker may try to exhaust ressources such as disk space and RAM. If possible, limit this value to a reasonable minimum, e.g. 1024.",
		'mail.add_x_header' => "Information Disclosure: When sending e-mails, a header 'X-PHP-Originating-Script' contains the filename of the originating script. In production this feature should be disabled.",
		'intl.default_locale' => "The ICU default locale is not set explicitly, which forces the usage of ICU's default locale.",
		'intl.error_level' => "An error induced by an attacker can change the program's control flow and may lead to unexpected side-effects.",
		'intl.use_exceptions' => "If unhandled, exceptions may have unexpected side-effects. Please make sure potential exceptions are handled correctly when calling intl-functions.",
		'last_modified' => "The Last-Modified header will be sent for PHP scripts. This is a minor information disclosure.",
		'zend.multibyte' => "This is highly unusual. If possible, try to avoid multibyte encodings in source files - like SJIS, BIG5 - and use UTF-8 instead. Most XSS and other injection protections are not aware of multibyte encodings or can easily be confused. In order to use UTF-8, this option can safely be deactivated.",
		'max_input_vars' => "This setting may be incorrect. Unless your application actually needs an incredible number of input variables, please set this to a reasonable value, e.g. 1000.",
		'phar.readonly' => "The creation and modification of phar files should be disabled in production.",
		'phar.require_hash' => "Signature validation for phar archives should be enforced. In particular having OpenSSL-type Phar signatures can significantly increase security.",
		'ffi.enable' => "From the PHP documentation: 'FFI is dangerous, since it allows to interface with the system on a very low level. The FFI extension should only be used by developers having a working knowledge of C and the used C APIs.'. Also, this extension is EXPERIMENTAL.",
		'runkit.internal_override' => "Runkit can modify/rename/remove internal functions. As most security features rely on internal functions, activating this setting renders all security features useless. In fact, it is best to remove the runkit extension altogether."
	];

	// php.ini checks
	foreach (ini_get_all(null, false) as $k => $v) {
		$meta = tdesc("php.ini / $k");
		$result = NULL;
		$reason = NULL;
		$recommendation = NULL;
		if (isset($helptext[$k])) { $recommendation = $helptext[$k]; }
		$ignore = 0;

		// opcache directives are performance-related, not security-relevant
		if (str_starts_with($k, 'opcache.')) {
			[$result, $reason] = [TEST_OK, "any value is ok"];
			tres($meta, $result, $reason);
			continue;
		}

		switch ($k) {
		case 'display_errors':
			if (is_on($v)) {
				[$result, $reason] = [TEST_MEDIUM, "display_errors is on."];
			}
			break;
		case 'display_startup_errors':
			if (is_on($v)) {
				[$result, $reason] = [TEST_MEDIUM, "display_startup_errors is on."];
				$recommendation = $helptext['display_errors'];
			}
			break;
		case 'log_errors':
			if (!is_on($v)) {
				[$result, $reason] = [TEST_LOW, "You are not logging errors."];
			}
			break;
		case 'expose_php':
			if (is_on($v)) {
				[$result, $reason] = [TEST_LOW, "PHP is exposed by HTTP headers."];
			}
			break;
		case 'max_execution_time':
			if (intval($v) == 0) {
				[$result, $reason] = [TEST_MEDIUM, "Execution time is not limited."];
			} elseif (intval($v) >= 300) {
				[$result, $reason] = [TEST_LOW, "Execution time limit is rather high."];
			}
			break;
		case 'max_input_time':
			if ($v == "-1") {
				[$result, $reason] = [TEST_MAYBE, "Input parsing time not limited."];
			}
			break;
		case 'max_input_nesting_level':
			if (intval($v) > 128) {
				[$result, $reason] = [TEST_MEDIUM, "Input nesting level extremely high."];
			} elseif (intval($v) > 64) {
				[$result, $reason] = [TEST_MAYBE, "Input nesting level higher than usual."];
			}
			break;
		case 'max_input_vars':
			if (intval($v) > 5000) {
				[$result, $reason] = [TEST_MEDIUM, "Extremely high number."];
			} elseif (intval($v) > 1000) {
				[$result, $reason] = [TEST_MAYBE, "Higher number than usual."];
			}
			break;
		case 'memory_limit':
			$v = ini_atol($v);
			if ($v < 0) {
				[$result, $reason] = [TEST_HIGH, "Memory limit deactivated."];
			} elseif ($v >= 128*1024*1024) { // default value
				[$result, $reason] = [TEST_MAYBE, "Memory limit is 128M or more."];
			}
			break;
		case 'post_max_size':
			$tmp = ini_atol(ini_get('memory_limit'));
			$v = ini_atol($v);
			if ($tmp < 0) {
				if ($v >= ini_atol('2G')) {
					[$result, $reason] = [TEST_MAYBE, "post_max_size is >= 2G."];
				}
				break;
			}
			if ($v > $tmp) {
				[$result, $reason] = [TEST_HIGH, "post_max_size is greater than memory_limit."];
				$recommendation = $helptext['post_max_size>memory_limit'];
			}
			break;
		case 'upload_max_filesize':
			if ($v === "2M") {
				[$result, $reason] = [TEST_COMMENT, "default value."];
			} elseif (ini_atol($v) >= ini_atol("2G")) {
				[$result, $reason] = [TEST_MAYBE, "value is rather high."];
			}
			break;
		case 'max_file_uploads':
			if (intval($v) > 30) {
				[$result, $reason] = [TEST_MAYBE, "value is rather high."];
			}
			break;
		case 'allow_url_fopen':
			if (is_on($v)) {
				[$result, $reason] = [TEST_HIGH, "fopen() is allowed to open URLs."];
			}
			break;
		case 'allow_url_include':
			if (is_on($v)) {
				[$result, $reason] = [TEST_HIGH, "include/require() can include URLs."];
			}
			break;
		case 'enable_dl':
			if (is_on($v)) {
				[$result, $reason] = [TEST_HIGH, "PHP can load extensions during runtime."];
			}
			break;
		case 'disable_functions':
			$v = ini_list($v);
			if (!$v) {
				[$result, $reason] = [TEST_MEDIUM, "no functions disabled."];
			}
			break;
		case 'disable_classes':
			$v = ini_list($v);
			if (!$v) {
				[$result, $reason] = [TEST_MEDIUM, "no classes disabled."];
			}
			break;
		case 'request_order':
			if ($v === null || $v === "") { $v = ini_get("variables_order"); }
			$v = strtoupper((string)$v);
			if ($v === "GP") {break;} // ok
			if (str_contains($v, 'C')) {
				[$result, $reason] = [TEST_MAYBE, "cookie values in \$_REQUEST."];
			}
			if (str_contains(str_replace('C', '', $v), 'PG')) {
				[$result, $reason] = [TEST_LOW, "GET overrides POST in \$_REQUEST."];
			}
			break;
		case 'variables_order':
			if ($v === "GPCS") { break; }
			if ($v !== "EGPCS") {
				[$result, $reason] = [TEST_COMMENT, "custom variables_order."];
			} else {
				$result = TEST_OK; // result set includes default helptext
			}
			break;
		case 'auto_globals_jit':
			$result = TEST_OK;
			break;
		case 'file_uploads':
			if ($v == "1") {
				[$result, $reason] = [TEST_MAYBE, "file uploads are allowed."];
			}
			break;
		case 'filter.default':
			if ($v !== "unsafe_raw") {
				[$result, $reason] = [TEST_MAYBE, "default input filter set."];
			}
			break;
		case 'open_basedir':
			if ($v == "") {
				[$result, $reason] = [TEST_LOW, "open_basedir not set."];
			}
			break;
		case 'session.save_path':
			if ($v == "") {
				[$result, $reason] = [TEST_MAYBE, "session save path not set."];
			}
			break;
		case 'session.cookie_httponly':
			if (!is_on($v)) {
				[$result, $reason] = [TEST_MAYBE, "no implicit httpOnly-flag for session cookie."];
			}
			break;
		case 'session.cookie_secure':
			if (!is_on($v)) {
				[$result, $reason] = [TEST_MAYBE, "no implicit secure-flag for session cookie."];
			}
			break;
		case 'session.cookie_lifetime':
			if (!is_on($v)) {
				[$result, $reason] = [TEST_MAYBE, "no implicit lifetime for session cookie."];
			}
			break;
		case 'session.cookie_samesite':
			if ($v == "") {
				[$result, $reason] = [TEST_MAYBE, "SameSite is unset."];
			} elseif ($v !== "Strict") {
				[$result, $reason] = [TEST_COMMENT, "SameSite is not set to `Strict`. If cross-site GET requests to your site are unlikely, this should be set to `Strict`."];
			}
			break;
		case 'session.referer_check':
			if ($v === "") {
				[$result, $reason] = [TEST_COMMENT, "referer check not activated."];
			}
			break;
		case 'session.use_strict_mode':
			if (!is_on($v)) {
				[$result, $reason] = [TEST_MEDIUM, "strict mode not activated."];
			}
			break;
		case 'session.use_cookies':
			if (!is_on($v)) {
				[$result, $reason] = [TEST_HIGH, "Session ID not stored in cookie."];
			}
			break;
		case 'session.use_only_cookies':
			if (!is_on($v)) {
				[$result, $reason] = [TEST_HIGH, "Session ID not limited to cookie."];
			}
			break;
		case 'session.name':
			if ($v == "PHPSESSID") {
				[$result, $reason] = [TEST_COMMENT, "default session name."];
			}
			break;
		case 'session.use_trans_sid':
			if (is_on($v)) {
				[$result, $reason] = [TEST_HIGH, "transparent SID active."];
			}
			break;
		case 'session.sid_length':
			if (intval($v) < 32) {
				[$result, $reason] = [TEST_HIGH, "Session ID length is too short (< 32)."];
			} elseif (intval($v) < 48) {
				[$result, $reason] = [TEST_COMMENT, "Session ID length could be increased."];
			}
			break;
		case 'session.sid_bits_per_character':
			if (intval($v) < 4) {
				[$result, $reason] = [TEST_MEDIUM, "Session ID bits per character too low (< 4)."];
			} elseif (intval($v) == 4) {
				[$result, $reason] = [TEST_COMMENT, "Default value. Consider increasing to 5 or 6."];
			}
			break;
		case 'session.serialize_handler':
			if ($v === 'php') {
				[$result, $reason] = [TEST_MEDIUM, "Legacy session serializer 'php' is in use."];
			}
			break;
		case 'session.gc_maxlifetime':
			if (intval($v) > 86400) {
				[$result, $reason] = [TEST_COMMENT, "Session lifetime is over 24 hours."];
			}
			break;
		case 'serialize_precision':
			if ($v !== "-1" && intval($v) != -1) {
				[$result, $reason] = [TEST_COMMENT, "serialize_precision is not -1."];
			}
			break;
		case 'arg_separator.input':
		case 'arg_separator.output':
			if ($v !== "&") {
				[$result, $reason] = [TEST_MAYBE, "unusual arg separator."];
				$recommendation = $helptext['arg_separator'];
			}
			break;
		case 'assert.active':
			if (is_on($v)) {
				[$result, $reason] = [TEST_MEDIUM, "assert is active."];
			}
			break;
		case 'assert.callback':
			if (ini_get('assert.active') && $v !== "" && $v !== null) {
				[$result, $reason] = [TEST_MEDIUM, "assert callback set."];
			}
			break;
		case 'zend.assertions':
			if (intval($v) > 0) {
				[$result, $reason] = [TEST_MEDIUM, "assert is active."];
			}
			break;
		case 'zend.exception_ignore_args':
			if (!is_on($v)) {
				[$result, $reason] = [TEST_MAYBE, "Stack traces may include function arguments."];
			}
			break;
		case 'zend.exception_string_param_max_len':
			if (intval($v) > 0) {
				[$result, $reason] = [TEST_COMMENT, "String parameters visible in stack traces."];
			}
			break;
		case 'auto_append_file':
		case 'auto_prepend_file':
			if ($v !== NULL && $v !== "") {
				[$result, $reason] = [TEST_MAYBE, "$k is set."];
				$recommendation = $helptext['auto_append_file'];
			}
			break;
		case 'cli.pager':
			if ($v !== NULL && $v !== "") {
				[$result, $reason] = [TEST_MAYBE, "CLI pager set."];
			}
			break;
		case 'cli.prompt':
			if ($v !== NULL && strlen($v) > 32) {
				[$result, $reason] = [TEST_MAYBE, "CLI prompt is rather long (>32)."];
			}
			break;
		case 'curl.cainfo':
			if ($v !== "") {
				if ($cfg['is_win']) {
					$is_absolute = (strlen($v) >= 3 && substr($v, 1, 2) === ":" . DIRECTORY_SEPARATOR);
				} else {
					$is_absolute = (substr($v, 0, 1) === DIRECTORY_SEPARATOR);
				}
				if (!$is_absolute) {
					[$result, $reason] = [TEST_LOW, "CURLOPT_CAINFO must be an absolute path."];
				} elseif (!is_readable($v)) {
					[$result, $reason] = [TEST_LOW, "CURLOPT_CAINFO is set but not readable."];
				}

			}
			break;
		case 'openssl.cafile':
			if (strlen($v) > 0 && !file_exists($v)) {
				[$result, $reason] = [TEST_MEDIUM, "OpenSSL CA file does not exist: $v"];
			}
			break;
		case 'openssl.capath':
			if (strlen($v) > 0 && !is_dir($v)) {
				[$result, $reason] = [TEST_MEDIUM, "OpenSSL CA path does not exist: $v"];
			}
			break;
		case 'docref_root':
		case 'docref_ext':
			if ($v !== NULL && $v !== "") {
				[$result, $reason] = [TEST_LOW, "docref is set."];
				$recommendation = $helptext['docref_*'];
			}
			break;
		case 'default_charset':
			if ($v == "") {
				[$result, $reason] = [TEST_HIGH, "default charset not explicitly set."];
				$recommendation = $helptext['default_charset=empty'];
			} elseif (stripos($v, "iso-8859") === 0) {
				[$result, $reason] = [TEST_MAYBE, "charset without multibyte support."];
				$recommendation = $helptext['default_charset=iso-8859'];
			} elseif (strtolower($v) == "utf8") {
				[$result, $reason] = [TEST_HIGH, "'UTF-8' misspelled (without dash)."];
				$recommendation = $helptext['default_charset=typo'];
			} elseif (strtolower($v) == "utf-8") {
				// ok.
			} else {
				[$result, $reason] = [TEST_COMMENT, "custom charset."];
				$recommendation = $helptext['default_charset=custom'];
			}
			break;
		case 'default_mimetype':
			if ($v == "") {
				[$result, $reason] = [TEST_HIGH, "default mimetype not set."];
			}
			break;
		case 'default_socket_timeout':
			if (intval($v) > 60) {
				[$result, $reason] = [TEST_LOW, "default socket timeout rather big."];
			}
			break;
		case 'doc_root':
			if (!$cfg['is_cgi']) {
				[$result, $reason] = [TEST_SKIPPED, "no CGI environment."];
				break;
			}
			if (ini_get('cgi.force_redirect')) {
				[$result, $reason] = [TEST_SKIPPED, "cgi.force_redirect is on instead."];
				break;
			}
			if ($v == "") {
				[$result, $reason] = [TEST_MEDIUM, "doc_root not set."];
				$recommendation = $helptext['doc_root=empty'];
			}
			break;
		case 'error_prepend_string':
		case 'error_append_string':
			if ($v !== NULL && $v !== "") {
				[$result, $reason] = [TEST_MAYBE, "$k is set."];
				$recommendation = $helptext['error_append_string'];
			}
			break;
		case 'error_reporting':
			if (error_reporting() == 0) {
				[$result, $reason] = [TEST_LOW, "error reporting is off."];
			}
			break;
		case 'extension_dir':
			if ($v !== NULL && $v !== "") {
				if (realpath($v) === FALSE) {
					[$result, $reason] = [TEST_SKIPPED, "path is invalid or not accessible."];
				} elseif (is_writable($v) || is_writable_or_chmodable($v)) {
					[$result, $reason] = [TEST_HIGH, "path is writable or chmod-able."];
				}
			}
			break;
		case 'exit_on_timeout':
			if (!isset($_SERVER["SERVER_SOFTWARE"]) || strncmp($_SERVER["SERVER_SOFTWARE"], "Apache/1", strlen("Apache/1")) !== 0) {
				[$result, $reason] = [TEST_SKIPPED, "only relevant for Apache 1."];
			} elseif (!is_on($v)) {
				[$result, $reason] = [TEST_LOW, "not enabled."];
			}
			break;
		case 'filter.default':
			if ($v !== "unsafe_raw") {
				[$result, $reason] = [TEST_MAYBE, "global input filter is set."];
			}
			break;
		case 'highlight.bg':
		case 'highlight.comment':
		case 'highlight.default':
		case 'highlight.html':
		case 'highlight.keyword':
		case 'highlight.string':
			if ((extension_loaded('pcre') && preg_match('/[^#a-z0-9]/i', $v)) || strlen($v) > 7 || str_contains($v, '"')) {
				[$result, $reason] = [TEST_MEDIUM, "suspicious color value."];
				$recommendation = $helptext['highlight.*'];
			}
			break;
		case 'iconv.internal_encoding':
		case 'iconv.input_encoding':
		case 'iconv.output_encoding':
			if ($v !== "") {
				[$result, $reason] = [TEST_COMMENT, "not empty."];
				$recommendation = $helptext['iconv.internal_encoding!=empty'];
			}
			break;
		case 'ldap.max_links':
			if (intval($v) == -1) {
				[$result, $reason] = [TEST_MAYBE, "Number of LDAP connections not limited."];
			} else if (intval($v) > 5) {
				[$result, $reason] = [TEST_MAYBE, "More than 5 LDAP connections allowed."];
			}
			break;
		case 'log_errors_max_len':
			$v = ini_atol($v);
			if ($v == 0 || $v > 4096) {
				[$result, $reason] = [TEST_MEDIUM, "Value rather big or not limited."];
			}
			break;
		case 'mail.add_x_header':
			if ($v) {
				[$result, $reason] = [TEST_MEDIUM, "Filename exposed."];
			}
			break;
		case 'mail.force_extra_parameters':
			if ($v) {
				[$result, $reason] = [TEST_COMMENT, "not empty."];
				$recommendation = "just FYI.";
			}
			break;
		case 'intl.default_locale':
			if ($v == "")  {
				[$result, $reason] = [TEST_COMMENT, "ICU default locale not set."];
			}
			break;
		case 'intl.error_level':
			if (intval($v) & E_ERROR) {
				[$result, $reason] = [TEST_MAYBE, "ICU functions fail with error."];
			}
			break;
		case 'intl.use_exceptions':
			if (is_on($v)) {
				[$result, $reason] = [TEST_MAYBE, "intl functions throw exceptions."];
			}
			break;
		case 'last_modified':
			if (is_on($v)) {
				[$result, $reason] = [TEST_LOW, "is set."];
			}
			break;
		case 'zend.multibyte':
			if (is_on($v)) {
				[$result, $reason] = [TEST_HIGH, "Multibyte encodings are active."];
			}
			break;
		case 'runkit.internal_override':
			if (is_on($v)) {
				[$result, $reason] = [TEST_CRITICAL, "Internal functions override is enabled"];
			}
			break;
		case 'phar.readonly':
			if (!is_on($v)) {
				[$result, $reason] = [TEST_LOW, "Phar files aren't readonly."];
			}
			break;
		case 'phar.require_hash':
			if (!is_on($v)) {
				[$result, $reason] = [TEST_LOW, "Signature check for phar is disabled."];
			}
			break;
		case 'ffi.enable':
			if (is_on($v)){
				[$result, $reason] = [TEST_HIGH, "FFI is enabled."];
			}
			break;
		case 'sqlite3.defensive':
			if (!is_on($v)) {
				[$result, $reason] = [TEST_MEDIUM, "SQLite3 defensive mode is disabled."];
			}
			break;
		case 'sqlite3.extension_dir':
			if (strlen($v) > 0 && is_writable_or_chmodable($v)) {
				[$result, $reason] = [TEST_MEDIUM, "SQLite3 extension directory is writable."];
			}
			break;
		case 'unserialize_max_depth':
			if (intval($v) === 0) {
				[$result, $reason] = [TEST_MEDIUM, "Deserialization depth limit is disabled."];
			}
			break;
		case 'max_multipart_body_parts':
			if (intval($v) < 0) {
				[$result, $reason] = [TEST_MEDIUM, "No limit on multipart body parts."];
			}
			break;
		case 'pcre.backtrack_limit':
			if (intval($v) === 0) {
				[$result, $reason] = [TEST_COMMENT, "PCRE backtrack limit is unlimited."];
				$recommendation = "Unlimited backtracking can lead to ReDoS. The default value of 1000000 is recommended.";
			}
			break;
		case 'pcre.recursion_limit':
			if (intval($v) === 0) {
				[$result, $reason] = [TEST_COMMENT, "PCRE recursion limit is unlimited."];
				$recommendation = "Unlimited recursion can cause stack exhaustion. The default value of 100000 is recommended.";
			}
			break;
		case 'error_log_mode':
			$mode = intval($v, 8);
			if ($mode & 0002) {
				[$result, $reason] = [TEST_LOW, "Error log is world-writable (mode $v)."];
				$recommendation = "Error logs may contain sensitive information. Set error_log_mode to 0600 or 0640.";
			} elseif ($mode & 0004) {
				[$result, $reason] = [TEST_COMMENT, "Error log is world-readable (mode $v)."];
				$recommendation = "Error logs may contain sensitive information. Consider restricting with error_log_mode=0600.";
			}
			break;
		case 'register_argc_argv':
			if (is_on($v) && !$cfg['is_cli']) {
				[$result, $reason] = [TEST_COMMENT, "register_argc_argv is enabled in web mode."];
				$recommendation = "In web mode, this creates \$argc/\$argv from the query string, which is unnecessary and wasteful.";
			}
			break;

		/* ===== known, but extra check below. ===== */
		case 'error_log':
		case 'include_path':
		case 'mail.log':
		case 'sendmail_path':
		case 'upload_tmp_dir':
			// silently ignore this option
			$ignore = 1;
			break;

		/* ===== known, but probably not security relevant ===== */
		case 'precision':
		case 'assert.bail':
		case 'assert.warning':
		case 'assert.exception':
		case 'auto_detect_line_endings':
		case 'bcmath.scale':
		case 'browscap':
		case 'date.default_latitude':
		case 'date.default_longitude':
		case 'date.sunrise_zenith':
		case 'date.sunset_zenith':
		case 'date.timezone':
		case 'dba.default_handler':
		case 'enable_post_data_reading':
		case 'engine': // can only be 1 here anyway.
		case 'exif.decode_jis_intel':
		case 'exif.decode_jis_motorola':
		case 'exif.decode_unicode_intel':
		case 'exif.decode_unicode_motorola':
		case 'exif.encode_jis':
		case 'exif.encode_unicode':
		case 'fatal_error_backtraces':
		case 'fiber.stack_size':
		case 'filter.default_flags':
		case 'from':
		case 'gd.jpeg_ignore_warning':
		case 'hard_timeout':
		case 'html_errors':
		case 'ignore_repeated_errors':
		case 'ignore_repeated_source':
		case 'ignore_user_abort':
		case 'implicit_flush':
		case 'input_encoding':
		case 'internal_encoding':
		case 'mail.cr_lf_mode':
		case 'mail.mixed_lf_and_crlf':
		case 'max_memory_limit':
		case 'openssl.libctx':
		case 'output_buffering':
		case 'output_encoding':
		case 'output_handler':
		case 'pcre.jit':
		case 'phar.cache_list':
		case 'realpath_cache_size':
		case 'realpath_cache_ttl':
		case 'report_memleaks': // may be relevant, but only active in debug builds anyway
		case 'report_zend_debug':
		case 'sendmail_from':
		case 'session.auto_start':
		case 'session.cache_expire':
		case 'session.cache_limiter':
		case 'session.cookie_domain':
		case 'session.cookie_partitioned':
		case 'session.cookie_path':
		case 'session.gc_divisor':
		case 'session.gc_probability':
		case 'session.lazy_write':
		case 'session.save_handler':
		case 'session.trans_sid_hosts':
		case 'session.trans_sid_tags':
		case 'session.upload_progress.cleanup':
		case 'session.upload_progress.enabled':
		case 'session.upload_progress.freq':
		case 'session.upload_progress.min_freq':
		case 'session.upload_progress.name':
		case 'session.upload_progress.prefix':
		case 'short_open_tag':
		case 'SMTP':
		case 'smtp_port':
		case 'sys_temp_dir':
		case 'syslog.facility':
		case 'syslog.filter':
		case 'syslog.ident':
		case 'unserialize_callback_func':
		case 'url_rewriter.hosts':
		case 'url_rewriter.tags':
		case 'user_agent':
		case 'user_dir':
		case 'user_ini.cache_ttl':
		case 'user_ini.filename':
		case 'xmlrpc_error_number':
		case 'xmlrpc_errors':
		case 'zend.detect_unicode':
		case 'zend.enable_gc':
		case 'zend.max_allowed_stack_size':
		case 'zend.reserved_stack_size':
		case 'zend.script_encoding':
		case 'zend.signal_check':
		case 'zlib.output_compression':
		case 'zlib.output_compression_level':
		case 'zlib.output_handler':
			[$result, $reason] = [TEST_OK, "any value is ok"];
			break;

		/* ===== unknown / ignored ===== */
		default:
			[$result, $reason] = [TEST_UNKNOWN, "unknown / not checked."];
		}

		if ($ignore) { continue; }

		if ($result === NULL) {
			tres($meta, TEST_OK);
		} elseif ($result === TEST_SKIPPED) {
			tres($meta, $result, $reason);
		} else {
			tres($meta, $result, $reason, $recommendation);
		}
	}
}
test_all_ini_entries();

// --- other checks ---

// old version of this script?
function test_pcc_need_update()
{
	global $cfg, $pcc_date, $pcc_version;

	date_default_timezone_set("UTC"); // avoid incorrect timezone warnings in strtotime()
	if (stripos($pcc_version, "-dev") !== FALSE || stripos($pcc_version, "-rc") !== FALSE) {
		if (time() > strtotime($pcc_date) + (24*3600*90)) { $cfg['need_update'] = 1; }
	} elseif (time() > strtotime($pcc_date) + (24*3600*270)) { $cfg['need_update'] = 1; }

}
test_pcc_need_update();


// old php version?
function test_old_php_version()
{
	$meta = tdesc("PHP Version", "Checks whether your PHP version is unsupported");
	if (version_compare(PHP_VERSION, '8.3') >= 0) {
		tres($meta, TEST_OK, "PHP version = " . PHP_MAJOR_VERSION . "." . PHP_MINOR_VERSION);
	} elseif (version_compare(PHP_VERSION, '8.2') >= 0) {
		tres($meta, TEST_LOW, "PHP " . PHP_MAJOR_VERSION . "." . PHP_MINOR_VERSION . " is in security-only support",
			"PHP 8.2 receives only security fixes. Consider upgrading to PHP 8.3 or 8.4 for full support.");
	} elseif (version_compare(PHP_VERSION, '8.1') >= 0) {
		tres($meta, TEST_HIGH, "PHP " . PHP_MAJOR_VERSION . "." . PHP_MINOR_VERSION . " is end-of-life",
			"PHP 8.1 security support ended in December 2025. " .
			"Please upgrade PHP as soon as possible.");
	} else {
		tres($meta, TEST_CRITICAL, "PHP version is older than 8.1",
			"Please upgrade PHP as soon as possible. " .
			"Old versions of PHP are not maintained anymore and may contain security flaws.");
	}
}
test_old_php_version();


// snuffleupagus installed?
function test_snuffleupagus_installed()
{
	$meta = tdesc("Snuffleupagus", "Checks whether the Snuffleupagus extension is loaded");
	if (extension_loaded("snuffleupagus")) {
		tres($meta, TEST_OK);
	} else {
		tres($meta, TEST_MAYBE, "The Snuffleupagus extension is not loaded", "Snuffleupagus is an advanced protection system for PHP7+. It is designed to protect servers and users from known and unknown flaws in PHP applications and the PHP core. For more information see https://snuffleupagus.rtfd.io");
	}
}
test_snuffleupagus_installed();


// logfile inside document root?
function test_log_in_document_root($inientry, $value_if_not_set=null)
{
	global $cfg;

	$inivalue = ini_get($inientry);
	if ($inivalue === "" || $inivalue === false) {
		$inivalue = $value_if_not_set;
	}

	$meta = tdesc("$inientry in document root", "Checks if $inientry path is in the current document root");
	if ($cfg['is_cli']) { tres($meta, TEST_SKIPPED, "CLI"); }
	elseif ($inivalue === null) { tres($meta, TEST_SKIPPED, "$inientry not set."); }
	elseif ($inientry === 'error_log' && ini_get($inientry) === "syslog") { tres($meta, TEST_SKIPPED, "error_log to syslog."); }
	elseif (!isset($_SERVER['DOCUMENT_ROOT'])) { tres($meta, TEST_SKIPPED, "DOCUMENT_ROOT not set."); }
	else {
		$log_realpath = realpath($inivalue);
		$document_root_realpath = realpath($_SERVER['DOCUMENT_ROOT']);
		if ($log_realpath === FALSE) { /* maybe new/nonexistent file? => use dirname instead */
			$log_realpath = realpath(dirname($inivalue));
		}
		if ($log_realpath === FALSE) { tres($meta, TEST_SKIPPED, "$inientry invalid or relative path."); }
		elseif ($document_root_realpath === FALSE) { tres($meta, TEST_SKIPPED, "DOCUMENT_ROOT invalid or relative path."); }
		elseif (strncmp($log_realpath . DIRECTORY_SEPARATOR, $document_root_realpath . DIRECTORY_SEPARATOR, strlen($document_root_realpath)+1) === 0) {
			tres($meta, TEST_HIGH, "$inientry in DOCUMENT_ROOT.", "The $inientry logfile is located inside the document root directory and may be accessible publicly. Logfiles should always point to a file outside the document root.");
		} else { tres($meta, TEST_OK, "$inientry outside of DOCUMENT_ROOT."); }
	}
}
test_log_in_document_root('error_log');
test_log_in_document_root('mail.log');
test_log_in_document_root('upload_tmp_dir', sys_get_temp_dir());


// writable document root?
function test_writable_document_root()
{
	$meta = tdesc("Writable document root", "Checks if the current document root is writable");
	if (!isset($_SERVER['DOCUMENT_ROOT'])) { tres($meta, TEST_SKIPPED, "DOCUMENT_ROOT not set."); }
	elseif (is_writable($_SERVER['DOCUMENT_ROOT'])) {
		tres($meta, TEST_HIGH, "document root is writable.", "Making the document root writable may give an attacker the advantage of persisting an exploit. It is probably best to restrict write access to the document root and its subdirectories. Temporary files your application may need to write can be safely stored outside the document root.");
	} elseif (is_writable_or_chmodable($_SERVER['DOCUMENT_ROOT'])) {
		tres($meta, TEST_MEDIUM, "document root is potentially writable.", "The document root's access permissions prevent write access, but the current user has the right to change these permissions. Please change the directory's owner.");
	} else {
		tres($meta, TEST_OK, "document root not writable.");
	}
}
test_writable_document_root();


// include_path writable?
function test_include_path_writable()
{
	$meta = tdesc("Writable include_path", "Checks if at least one directory listed in the include_path is writable");
	$result = 0;
	$checked = 0;
	foreach (explode(PATH_SEPARATOR, ini_get('include_path')) as $dir) {
		if ($dir === "") { continue; }
		$checked++;
		$absdir = realpath($dir);
		if ($absdir === FALSE) { continue; } // path does not exist? -> ignore
		if (is_writable($absdir)) {
			tres($meta, TEST_HIGH, "The directory '" . $dir . "' is writable.", "An attacker may try to place a file here.");
			$result = 1;
		} else if (is_writable_or_chmodable($absdir)) {
			tres($meta, TEST_HIGH, "The directory '" . $dir . "' is potentially writable.", "The current user has the right to change its permissions.");
			$result = 1;
		}
	}
	if (!$result) {
		tres($meta, TEST_OK, "Checked $checked directories.");
	}
}
test_include_path_writable();

// sendmail writable?
function test_sendmail_writable()
{
	$meta = tdesc("sendmail writable", "Checks if the sendmail executable is writable");
	$sm = ini_get('sendmail_path');
	if ($sm == "" || $sm === NULL) {
		tres($meta, TEST_OK, "sendmail_path not set.");
		return;
	}
	$sm_chunks = explode(' ', $sm);
	$sm_executable = $sm_chunks[0];
	$sm_dir = dirname($sm_executable);
	if (is_file($sm_executable) || is_link($sm_executable)) {
		if (is_writable_or_chmodable($sm_executable)) {
			tres($meta, TEST_CRITICAL, "sendmail is writable", "The configured sendmail_path can be changed by the current user. Please change its permissions.");
			return;
		}
	}
	if (is_writable_or_chmodable(dirname($sm_executable)) || is_writable_or_chmodable(dirname(realpath($sm_executable)))) {
		tres($meta, TEST_CRITICAL, "The directory containing the sendmail_path executable is writable or its permission can be changed by the current user.");
		return;
	}
	tres($meta, TEST_OK, "sendmail_path is not writable.");
}
test_sendmail_writable();

// is debug build?
function test_debug_build()
{
	$meta = tdesc("Debug build", "Checks if PHP was built with --enable-debug");
	if ((defined('PHP_DEBUG') && PHP_DEBUG) || (defined('ZEND_DEBUG_BUILD') && ZEND_DEBUG_BUILD)) {
		tres($meta, TEST_MEDIUM, "debug build.", "Using a debug build of PHP makes it possible to enable debugging features in PHP, which can be useful for attackers, e.g. to get more accurate error messages or to simplify DoS attacks. Also, debugging may impact overall performance. This is probably not what you want in a production environment. Please recompile PHP without debugging.");
	} else {
		tres($meta, TEST_OK, "not a debug build.");
	}
}
test_debug_build();

// got root?
function test_godmode()
{
	global $cfg;
	$meta = tdesc("got root?", "Test for root access on non-windows systems");
	if ($cfg['is_win']) {
		tres($meta, TEST_SKIPPED, "windows."); // maybe check for admin access. but how?
		return;
	}
	if (!extension_loaded("posix")) {
		tres($meta, TEST_SKIPPED, "posix extension not available");
		return;
	}
	if (posix_getuid() == 0) {
		tres($meta, TEST_CRITICAL, "you are root!", "Executing PHP as root is hardly ever necessary.");
	} else {
		tres($meta, TEST_OK, "not root");
	}
}
test_godmode();

// test for xdebug extension
function test_xdebug()
{
	$meta = tdesc("xdebug", "Test for loaded xdebug extension");
	if (extension_loaded('xdebug')) {
		tres($meta, TEST_HIGH, "xdebug extension loaded.", "The xdebug extension can reveal code and data to an attacker and may have an impact on application performance, too. Please unload this extension in a production deployment.");
	} else {
		tres($meta, TEST_OK, "not loaded.");
	}
}
test_xdebug();

// test for vld extension
function test_vld()
{
	$meta = tdesc("vld", "Test for loaded vld extension");
	if (extension_loaded('vld')) {
		if (is_on(ini_get('vld.active'))) {
			tres($meta, TEST_CRITICAL, "vld extension loaded and active.", "The vld extension can reveal code and data to an attacker and may have an impact on application performance, too. Please unload this extension in a production deployment.");
		}
		tres($meta, TEST_HIGH, "vld extension loaded.", "The vld extension can reveal code and data to an attacker and may have an impact on application performance, too. Please unload this extension in a production deployment.");
	} else {
		tres($meta, TEST_OK, "not loaded.");
	}
}
test_vld();

/*****************************************************************************/

if (function_exists('posix_isatty') && defined('STDOUT') && posix_isatty(STDOUT)) {
	function colorize_result($result){
		$const_name = "ANSI_COLOR_" . $result;
		if (defined($const_name) && ($color = constant($const_name)) !== NULL) {
			return "\033[{$color}m$result\033[0m";
		}
		return $result;
	}
} else {
	function colorize_result($result) { return $result; }
}

// output
if ($cfg['output_type'] == "text") {
	echo $cfg['s1_logo_aa'] . "\n\n";
	if ($cfg['need_update']) { echo "[*] This script is rather old. Please check for updates:\n    $pcc_url\n\n"; }
	foreach ($all_result_codes as $sev) {
		if (!$cfg['showall'] && !in_array($sev, $cfg['result_codes_default'], true)) { continue; }
		if (!isset($trbs[$sev]) || !$trbs[$sev]) {continue;}
		foreach ($trbs[$sev] as $res) {
			echo sprintf("[%-8s] %s\n", colorize_result($res['result']), $res['name']);
			echo "  " . $res['reason'] . "\n  " . $res['recommendation'] . "\n";
		}
	}
} elseif ($cfg['output_type'] == "json") {
	echo json_encode($trbs);
} elseif ($cfg['output_type'] == "html") {
	function e($str) { return htmlentities($str, ENT_QUOTES); }
?>
<!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head><title><?php echo $pcc_name; ?></title>
<meta charset="utf-8"/>
<style type="text/css">
body {
	background-color: #fe9;
	color: #111;
	font-family: sans-serif;
}
body, tr, td, table, pre, div {
	font-size: 12px;
}
.<?php echo TEST_CRITICAL; ?> { background-color: #f0c; }
.<?php echo TEST_HIGH; ?>     { background-color: #f00; }
.<?php echo TEST_MEDIUM; ?>   { background-color: #fa0; }
.<?php echo TEST_LOW; ?>      { background-color: #ff0; }
.<?php echo TEST_MAYBE; ?>    { background-color: #1cc; }
.<?php echo TEST_COMMENT; ?>  { background-color: #fff; }
.<?php echo TEST_OK; ?>       { background-color: #0f0; }
.<?php echo TEST_SKIPPED; ?>  { background-color: #888; }
.<?php echo TEST_UNKNOWN; ?>  { background-color: #a50; }
.c {
	text-align: center;
}
td {
	vertical-align: top;
	border: 1px solid black;
	padding: 3px;
}
a:link {color: #0000a9; text-decoration: none;}
a:hover {text-decoration: underline;}
table {border-collapse: collapse;}
.t {
	width: 700px;
	margin-left: auto; margin-right: auto;
	text-align: left;
	margin-bottom: 10px;
}
.t1 {
	background-color: #fff;
}
img {
	float: right;
	border: 0px;
}
</style>
</head>
<body>
<div class="c">
	<table class="t t1">
		<tr><td>
			<a href="https://sektioneins.de/"><img src="<?php echo $cfg['s1_logo']; ?>" width="120" alt="SektionEins" /></a>
			<?php echo $pcc_name;?><br/>Version <?php echo $pcc_version;?><br/><?php echo $pcc_copy; ?>
		</td></tr>
	</table>
	<?php if ($cfg['need_update']): ?>
		<table class="t"><tr><td class="critical">[*] This script is rather old. Please check for updates: <a href="<?php echo $pcc_url; ?>"><?php echo $pcc_url; ?></a></td></tr></table>
	<?php endif ?>
	<table class="t"><tr>
	<?php
	foreach ($all_result_codes as $sev) {
		if (!$cfg['showall'] && !in_array($sev, $cfg['result_codes_default'], true)) { continue; }
		if (!isset($trbs[$sev])) {continue;}
	?>
		<td class="<?php echo $sev; ?>"><?php echo $sev; ?>: <?php echo count($trbs[$sev]); ?></td>
	<?php
	}
	?></tr></table>

	<table class="t">
	<tr>
		<th>Risk</th>
		<th>Name / Description</th>
		<th>Reason</th>
		<th>Recommendation</th>
	</tr>
	<?php
	foreach ($all_result_codes as $sev) {
		if (!$cfg['showall'] && !in_array($sev, $cfg['result_codes_default'], true)) { continue; }
		if (!isset($trbs[$sev]) || !$trbs[$sev]) {continue;}
		foreach ($trbs[$sev] as $res): ?>
		<tr class="<?php echo $res['result']; ?>">
			<td><?php echo $res['result']; ?></td>
			<td><?php echo e($res['name']); ?><?php if ($res['desc'] !== NULL) {echo "<br/>" . e($res['desc']);} ?></td>
			<td><?php echo e($res['reason']); ?></td>
			<td><?php echo e($res['recommendation']); ?></td>
		</tr>
		<?php endforeach;
	}
	?>
	</table>
</div>
</body>
</html>

<?php
}
?>