Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

php_uname() has been disabled for security reasons #6500

Closed
andykelk opened this issue Oct 22, 2014 · 1 comment
Closed

php_uname() has been disabled for security reasons #6500

andykelk opened this issue Oct 22, 2014 · 1 comment
Labels
wontfix If you can reproduce this issue, please reopen the issue or create a new one describing it.

Comments

@andykelk
Copy link

Since upgrading to the 2.8 piwik series, I've been getting cron emails when it runs the archive function. The full message is:

PHP Warning:  php_uname() has been disabled for security reasons in /var/www/html/piwik/vendor/symfony/console/Symfony/Component/Console/Output/ConsoleOutput.php on line 111.

I do have php_uname disabled ( from /etc/php.ini: disable_functions = "[...], php_uname, [...]" ) so I understand why the warning is displayed.

On inspecting the Symfony ConsoleOutput.php class, the method in question is :

protected function hasStdoutSupport()
{
    return ('OS400' != php_uname('s'));
}

Since I'm not on OS400, I've just patched it to always return true. This works without a problem. However, I need to keep patching when I upgrade piwik.

The alternative for me would be to remove php_uname from the disable_functions list. However, I'd rather not do that unless I was experiencing a fatal error.

The issue is present in current Symfony github, so probably not anything that piwik can do to fix it; I assume that it only surfaced about recently with a change in piwik to use the Console\Output\OutputInterface class.

This is not a high priority issue, but thought I'd pass it on in case anyone else experiences the same.

@mattab
Copy link
Member

mattab commented Oct 22, 2014

Thanks for the report @mopoke

As you said it's Symfony console responsibility to decide whether they want to work around this or not.

In general though I would recommend to remove php_uname from disable_functions if possible. Cheers

@mattab mattab closed this as completed Oct 22, 2014
@mattab mattab added the wontfix If you can reproduce this issue, please reopen the issue or create a new one describing it. label Oct 22, 2014
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
wontfix If you can reproduce this issue, please reopen the issue or create a new one describing it.
Projects
None yet
Development

No branches or pull requests

2 participants