Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add two sections to the VIP.RestrictedFunctions sniff. #584

Merged
merged 1 commit into from
Jul 11, 2016

Conversation

jrfnl
Copy link
Member

@jrfnl jrfnl commented Jul 11, 2016

Using ini_set() for alternating PHP settings, as well as other functions with ability to change configuration at runtime of your scripts, such as error_reporting(), is prohibited on the WordPress.com VIP platform. Allowed error reporting in production can lead to Full Path Disclosure.

See https://vip.wordpress.com/documentation/code-review-what-we-look-for/#settings-alteration

I've added the most obvious PHP functions which would relate to this. Careful review of the functions listed needed & appreciated.

Fixes #460

@JDGrimes
Copy link
Contributor

Looks good to me.

@westonruter westonruter merged commit 0a5973a into WordPress:develop Jul 11, 2016
@jrfnl jrfnl deleted the feature/issue-460-vip-ini-set branch July 11, 2016 18:59
@jrfnl
Copy link
Member Author

jrfnl commented Jul 11, 2016

Thanks ;-)

@jrfnl jrfnl added this to the 0.10.0 milestone Aug 27, 2016
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Add ini_set() to forbidden functions on WordPress.com VIP
4 participants