1、限制php高风险项目
编辑php配置文件
/usr/local/php/etc/php.ini
找到disable_functions =
添加限制条目
eval,assert,popen,passthru,escapeshellarg,esacapshellcmd,passthru,exec,system,chroot,scandir,chgrp,chown,shell_exec,proc_get_status,ini_restore,dl,pfsockopen,openlog,syslog,readlink,symlink,leak,popepassthru,stream_socket_server,proc_open,proc_close
2、访问错误提示显示开关关闭并且打开php错误日志记录
display_errors = Off
log_errors = On
3、更改日志文件位置
error_log = /usr/local/php/log/php_errors.log
4、更改错误级别
error_reporting = E_ALL & ~E_NOTICE
5、限制访问目录
open_basedir =/data/www:/tmp
也可以在虚拟主机配置文件限制访问目录
在此段 ServerAlias www.aaa.com下添加以下限制条件
php_admin_value open_basedir "/data/www:/tmp"
使用curl或浏览器访问显示结果为正确200
[root@redhat www2]# curl -x127.0.0.1:80 -I www.test.com/forum.php
HTTP/1.1 200 OK
Date: Thu, 26 May 2016 01:29:04 GMT
Server: Apache/2.2.31 (Unix) PHP/5.4.36
X-Powered-By: PHP/5.4.36
将正确目录改成错误目录/data/www2后
php_admin_value open_basedir "/data/www2:/tmp"
显示结果为错误500：
[root@redhat www2]# curl -x127.0.0.1:80 -I www.test.com/forum.php
HTTP/1.0 500 Internal Server Error
Date: Thu, 26 May 2016 01:48:31 GMT
Server: Apache/2.2.31 (Unix) PHP/5.4.36
X-Powered-By: PHP/5.4.36
Cache-Control: max-age=0
Expires: Thu, 26 May 2016 01:48:31 GMT
Connection: close
Content-Type: text/html