Changes between Initial Version and Version 2 of Ticket #62047
- Timestamp:
- 09/13/2024 03:32:30 PM (22 months ago)
Legend:
- Unmodified
- Added
- Removed
- Modified
-
Ticket #62047
- Property Milestone Awaiting Review
- Property Resolution → duplicate
- Property Status new → closed
-
Ticket #62047 – Description
initial v2 1 1 There is a bug in wordpress that prevents users from logging-in if their PHP server was hardened following common best-practices 2 2 3 ``` 3 {{{ 4 4 ini_set( 'display_errors', 1 ); 5 6 ``` 5 }}} 7 6 8 7 This line causes a PHP Fatal error on hardened systems with the `ini_set` function disabled. 9 8 10 ``` 9 {{{ 11 10 PHP Fatal error: Uncaught Error: Call to undefined function ini_set() in /mnt/hetznerVol3/high_priority/www/html/wordpress/htdocs/wp-includes/load.php:600 12 ``` 11 }}} 13 12 14 # Why this matters 13 **Why this matters** 15 14 16 15 For security reasons, orgs frequently configure `php.ini` to be hardened by adding many dangerous functions to the `disable_functions` variable in the `php.ini` file. For example, it's common to disable the 'exec' function 17 16 18 ``` 17 {{{ 19 18 disable_functions = exec 20 ``` 19 }}} 21 20 22 21 Of course, if a php script could modify the php configuration, then it would defeat any hardening done by setting `disable_functions`. As such, it's common to add `ini_set` to the `disable_functions` 23 22 24 ``` 23 {{{ 25 24 disable_functions = exec, ini_set 26 ``` 25 }}} 27 26 28 # Solution 27 **Solution** 29 28 30 29 To fix the PHP Fatal error, wordpres should always check to see if the `ini_set` function exists before attempting to call it 31 30 32 ``` 31 {{{ 33 32 if( function_exists( 'ini_set') ){ 34 33 ini_set( 'display_errors', 1 ); 35 34 } 36 ``` 35 }}}
![(please configure the [header_logo] section in trac.ini)](/chrome/site/your_project_logo.png)