PHP Disable Functions

This page explains the PHP Disable Functions feature in GoAdmio. It lets you enable or disable specific PHP functions for a domain account — including all dangerous functions that are disabled by default.

Location: Admin Panel → Security → PHP Disable Functions
Location (User Panel): Security → PHP Disable Functions (if enabled for the account)

Overview

PHP has many powerful functions — and some of them are dangerous in a shared hosting environment. Functions like exec(), shell_exec(), system(), and passthru() allow a PHP script to run arbitrary commands on the server. If a website is compromised, these functions let an attacker pivot from a single site to the whole server.

PHP Disable Functions lets you control which PHP functions are disabled for each domain account. The list is defined via PHP's disable_functions directive, and GoAdmio applies it per domain (via the domain's FPM pool or PHP configuration).

GoAdmio ships with a set of dangerous functions disabled by default — you can:

• Review the current list
• Add more functions to disable
• Remove a function from the list (enable it) — only when a specific application requires it

Dangerous Functions Disabled by Default

GoAdmio disables the following dangerous functions by default. These are the most commonly abused functions for privilege escalation, remote code execution, and server compromise:

| Function | Risk |
|---|---|
| exec | Execute an external program |
| shell_exec | Execute a command via the shell and return output |
| system | Execute a command and output the result |
| passthru | Execute a command and pass raw output to the browser |
| proc_open | Execute a command and open file pointers for I/O |
| popen | Open a process file pointer |
| pcntl_exec | Execute a program in the current process space |
| eval | Evaluate a string as PHP code |
| assert | Evaluate a string as PHP code (when used with a string argument) |
| create_function | Create an anonymous function from a string (deprecated) |
| include_once, include, require, require_once (when used with remote URLs) | Remote file inclusion |
| dl | Load a PHP extension at runtime |
| putenv | Modify the environment |
| ini_set, ini_alter | Modify PHP configuration at runtime (may be restricted) |
| symlink | Create symbolic links |
| link | Create hard links |
| chgrp, chown, chmod | Change file ownership and permissions |
| shell_exec, escapeshellarg, escapeshellcmd | Shell-related |
| phpinfo | Exposes server information |
| posix_kill, posix_mkfifo, posix_setpgid, posix_setsid, posix_setuid | Process and permission manipulation |

> Tip: The exact default list depends on your GoAdmio version. Review the page to see the current list — it is the authoritative source for your server.

> Warning: Disabling eval and assert can break some CMSs, plugins, and frameworks that use them for legitimate purposes (e.g., template engines, caching). Test after changing the list.

What the Page Shows

| Field / Column | Description |
|---|---|
| Domain | The domain whose disabled functions are being configured |
| Disabled Functions | The current list of disabled functions for that domain |
| Default List | The GoAdmio default list (if shown) |
| Actions | Add a function to disable, remove a function to enable |
| Search | Filter the list by function name |

> Tip: The list is per domain. Each domain can have its own set of disabled functions — a customer who needs exec() for a specific tool can have it enabled for their domain without affecting others.

How to Add a Function to the Disabled List

1. Log in to the GoAdmio Admin Panel (or User Panel).
2. Navigate to Security → PHP Disable Functions.
3. Select the domain.
4. Enter the function name to disable (e.g., curl_exec).
5. Click Add (or Disable).
6. Save.

> Tip: Disable functions one at a time and test after each change. Disabling several at once makes it hard to know which one broke the site.

How to Enable a Disabled Function

Some applications legitimately require functions that GoAdmio disables by default:

| Application | Function(s) it may need |
|---|---|
| ImageMagick / Imagick | exec, shell_exec |
| FFmpeg (video processing) | exec, shell_exec |
| Backup plugins | exec, shell_exec, proc_open |
| Composer (PHP dependency manager) | proc_open, exec |
| Some CMS plugins | eval, create_function |
| PDF generation | exec, shell_exec |
| Cron management plugins | exec, shell_exec |

To enable a function for a specific domain:

1. Open Security → PHP Disable Functions.
2. Select the domain.
3. Locate the function in the Disabled Functions list.
4. Click Remove (or Enable).
5. Save.

> Tip: After enabling a function, test the application feature that needed it. If the application still fails, check the PHP error log — the function may not be the actual cause.

How It Works

GoAdmio applies the disabled functions list via PHP's disable_functions directive:

• For FPM domains — in the domain's FPM pool configuration
• For mod_php domains — in the domain's php.ini (or via .htaccess if supported)

> Note: Disabling a function does not remove it from PHP — it makes it undefined at runtime. A script that calls it will fail with a fatal error.

> Tip: Verify the change from a test script:

```php
<?php
if (function_exists('exec')) {
echo "exec is ENABLED";
} else {
echo "exec is DISABLED";
}