PHP disable_functions for separated vhost

[JoeDer]

Hello,

I'm running PHP 7.4 as main PHP version and PHP-CGI selector v2 from PHP 5.6 to 7.4 versions, on my Invision Power installation I have a message to disable some dangerous PHP functions,



All I have done is to add in the domain's control panel the disable_functions as a new record in the php.ini and add the PHP functions that needed.



After that I still have the same message. From a search I found this article: http://wiki.centos-webpanel.com/how-to-disable-dangerous-php-functions but I don't want to disable any PHP function from all domains that use the same PHP version. 

What can I do to disable these PHP functions only for 1 domain?

[cinique]

Simple bit of debugging:
Temporarily create a phpinfo.php in the domain public_html and check which php.ini is being read.

[JoeDer]

There is no value at disable_functions in my public_html phpinfo file and that is the weird thing

[JoeDer]

[cinique]

user_ini.filename ?

[JoeDer]

Yes it exist in my public_html
php.ini and .user.ini with the same values.

[cinique]

Something peculiar to your setup. I normally use FPM these days but checked one client domain..
Apache/2.4.46
PHP Version 7.3.26
Configure Command    './configure' '--with-config-file-path=/usr/local/php' '--enable-cgi' '--with-config-file-scan-dir=/usr/local/php/php.d' '--with-zlib=/usr' '--enable-mbstring' '--enable-zip' '--enable-bcmath' '--enable-pcntl' '--enable-ftp' '--enable-exif' '--enable-calendar' '--enable-sysvmsg' '--enable-sysvsem' '--enable-sysvshm' '--enable-wddx' '--with-tidy' '--with-curl' '--with-iconv' '--with-gmp' '--with-pspell' '--with-gd' '--with-jpeg-dir=/usr' '--with-freetype-dir=/usr' '--with-png-dir=/usr' '--enable-gd-jis-conv' '--with-webp-dir=/usr' '--with-zlib-dir=/usr' '--with-xpm-dir=/usr' '--with-openssl' '--with-pdo-mysql=mysqlnd' '--with-gettext=/usr' '--with-bz2=/usr' '--with-recode=/usr' '--with-mysqli' '--enable-soap' '--enable-phar' '--with-xsl' '--with-xmlrpc' '--with-kerberos' '--enable-posix' '--enable-sockets' '--with-pcre-regex' '--with-libdir=lib64' '--with-mysql-sock=/var/lib/mysql/mysql.sock' '--enable-intl' '--with-icu-dir=/usr' '--enable-fpm'

Server API    CGI/FastCGI
Virtual Directory Support    disabled
Configuration File (php.ini) Path    /usr/local/php
Loaded Configuration File    /home/userdomain/public_html/php.ini
Scan this dir for additional .ini files    /usr/local/php/php.d
Additional .ini files parsed    /usr/local/php/php.d/ioncube.ini, /usr/local/php/php.d/mcrypt.ini

include_path   .:/usr/local/lib/php

user_ini.filename   .user.ini

[JoeDer]

How can I change the Loaded Configuration File to loaded at the domain's root folder?

I had also un-comment the below value because I have the .user.ini file with the same values as php.ini but seems to not work.

[cinique]

I have suggested to devs (on this forum) to change the wording of some of the menu items, as people are confused. They only partially took me up on my long lists of suggestions/corrections. 

You appear to be confusing the two PHP instances.
/usr/local/php = system PHP (also used when PHP Selector is not used, AFAIK)
/opt/alt/phpXX = user domain PHP

My example is from a free CWP installation, with no multi-PHP. I'll try to get a later one for you.. Bloody server has gone into meltdown, trying to add your bleeding edge PHP 7.4.xx, whilst running horrible Magento!

[JoeDer]

OK, thank you! I think if I can change the path to php.ini to load from users' root folder it will work.

[cinique]

Crikey, that was fun! 
I had to be careful as this was on a heavily used live system but I have got this to work, by default and no messing about with config files. I was using a munin account (see my tutorial), so it complicated things due to having a different document root.
Results:
PHP Version 7.4.14
Server API    CGI/FastCGI
Virtual Directory Support    disabled
Configuration File (php.ini) Path    /opt/alt/php74/usr/php
Loaded Configuration File    /var/www/html/munin/php.ini
Scan this dir for additional .ini files    /opt/alt/php74/usr/php/php.d
Additional .ini files parsed    /opt/alt/php74/usr/php/php.d/imagick.ini, /opt/alt/php74/usr/php/php.d/ioncube.ini

memory_limit   192M  <- changed specific to this account
user_ini.filename   .user.ini  <- this is being ignored, as it should, as not PHP-FPM (Edit: after-thought)

Notes:
GUI PHP Editor writes to /home/munin/public_html/php.ini (and replicates to .user.ini in the same directory)
  It should actually write to the munin.conf Document Root /var/www/html/munin - copied it to the correct place
PHP Selector writes the AddHandler to .htaccess, also rather than the Document Root - manually copied over.
Restart Apache

Confirmed by adding:
disable_functions   exec, system, shell_exec
Restart Apache

[JoeDer]

Where is the tutorial? Thare isn't any link. I switched to PHP-FPM from PHP-CGI and still can't figure how can work php.ini or .user.ini for any account separately.

[cinique]

Weird: didn't show up in a forum search for me! It's in "How To.."
http://forum.centos-webpanel.com/index.php?topic=10098.0
It was just to illustrate what you're trying to achieve but I recommend anyone/everyone to at least try munin - it has helped me analyse servers for many years. It beats sending out potentially sensitive information to 3rd parties (netstat) and doesn't consume resources like GoAccess.
It'll give you an opportunity to 'play' without affecting an end-user website.

[JoeDer]

I do not understand, what should I do with munin in relation to my issue?

[cinique]

I do not understand, what should I do with munin in relation to my issue?

"It was just to illustrate what you're trying to achieve.." "It'll give you an opportunity to 'play' without affecting an end-user website."
(Goes off to try another one of my servers, with 7.4.11 installed - this server is less used.)