Критический sendmail, доступный для записи с помощью PHP Secure Configuration Checker - PullRequest
0 голосов
/ 13 января 2019

Как решить эту проблему, если sendmail_path даже не определено

Риск: критический

Имя / Описание: sendmail доступно для записи. Проверяет, доступен ли для записи исполняемый файл sendmail

Причина: каталог, содержащий исполняемый файл sendmail_path, доступен для записи или текущий пользователь может изменить его разрешение.

изображение с php scc
image from php scc

phpinfo()

System => Linux localhost.localdomain 4.19.13-300.fc29.x86_64 #1 SMP Sat Dec 29 22:54:28 UTC 2018 x86_64
Build Date => Jan 12 2019 09:09:45
Configure Command =>  './configure'  '--prefix=/bsk/php9414' '--with-config-file-path=/bsk/php9414/etc' '--with-config-file-scan-dir=/bsk/php9414/etc/conf.d' '--with-apxs2=/bsk/apache1908/bin/apxs' '--enable-so' '--with-mysqli' '--with-gd' '--with-curl' '--enable-fpm' '--with-jpeg-dir' '--with-png-dir' '--enable-mbstring' '--with-openssl' '--enable-zip'
Server API => Command Line Interface
Virtual Directory Support => enabled
Configuration File (php.ini) Path => /bsk/php9414/etc
Loaded Configuration File => /bsk/php9414/etc/php.ini
Scan this dir for additional .ini files => /bsk/php9414/etc/conf.d
Additional .ini files parsed => (none)
PHP API => 20170718
PHP Extension => 20170718
Zend Extension => 320170718
Zend Extension Build => API320170718,TS
PHP Extension Build => API20170718,TS
Debug Build => no
Thread Safety => enabled
Zend Signal Handling => enabled
Zend Memory Manager => enabled
Zend Multibyte Support => provided by mbstring
IPv6 Support => enabled
DTrace Support => disabled

Registered PHP Streams => https, ftps, php, file, glob, data, http, ftp, phar, zip
Registered Stream Socket Transports => tcp, udp, unix, udg, ssl, sslv3, tls, tlsv1.0, tlsv1.1, tlsv1.2
Registered Stream Filters => convert.iconv.*, string.rot13, string.toupper, string.tolower, string.strip_tags, convert.*, consumed, dechunk

This program makes use of the Zend Scripting Language Engine:
Zend Engine v3.2.0, Copyright (c) 1998-2018 Zend Technologies


 _______________________________________________________________________


Configuration

Core

PHP Version => 7.2.14

Directive => Local Value => Master Value
allow_url_fopen => Off => Off
allow_url_include => Off => Off
arg_separator.input => & => &
arg_separator.output => & => &
auto_append_file => no value => no value
auto_globals_jit => On => On
auto_prepend_file => no value => no value
browscap => no value => no value
default_charset => UTF-8 => UTF-8
default_mimetype => text/html => text/html
disable_classes => test.test2 => test.test2
disable_functions => tester.tester2 => tester.tester2
display_errors => Off => Off
display_startup_errors => Off => Off
doc_root => no value => no value
docref_ext => no value => no value
docref_root => no value => no value
enable_dl => Off => Off
enable_post_data_reading => On => On
error_append_string => no value => no value
error_log => no value => no value
error_prepend_string => no value => no value
error_reporting => 22527 => 22527
expose_php => Off => Off
extension_dir => /bsk/php9414/lib/php/extensions/no-debug-zts-20170718 => /bsk/php9414/lib/php/extensions/no-debug-zts-20170718
file_uploads => On => On
hard_timeout => 2 => 2
highlight.comment => #FF8000 => #FF8000
highlight.default => #0000BB => #0000BB
highlight.html => #000000 => #000000
highlight.keyword => #007700 => #007700
highlight.string => #DD0000 => #DD0000
html_errors => Off => Off
ignore_repeated_errors => Off => Off
ignore_repeated_source => Off => Off
ignore_user_abort => Off => Off
implicit_flush => On => On
include_path => .:/bsk/php9414/lib/php => .:/bsk/php9414/lib/php
input_encoding => no value => no value
internal_encoding => no value => no value
log_errors => On => On
log_errors_max_len => 1024 => 1024
mail.add_x_header => Off => Off
mail.force_extra_parameters => no value => no value
mail.log => no value => no value
max_execution_time => 0 => 0
max_file_uploads => 20 => 20
max_input_nesting_level => 64 => 64
max_input_time => -1 => -1
max_input_vars => 1000 => 1000
memory_limit => 40M => 40M
open_basedir => / => /
output_buffering => 0 => 0
output_encoding => no value => no value
output_handler => no value => no value
post_max_size => 8M => 8M
precision => 14 => 14
realpath_cache_size => 4096K => 4096K
realpath_cache_ttl => 120 => 120
register_argc_argv => On => On
report_memleaks => On => On
report_zend_debug => Off => Off
request_order => GP => GP
sendmail_from => no value => no value
sendmail_path =>  -t -i  =>  -t -i 
serialize_precision => -1 => -1
short_open_tag => Off => Off
SMTP => localhost => localhost
smtp_port => 25 => 25
sys_temp_dir => no value => no value
track_errors => Off => Off
unserialize_callback_func => no value => no value
upload_max_filesize => 1M => 1M
upload_tmp_dir => no value => no value
**user_dir => no value => no value**
user_ini.cache_ttl => 300 => 300
user_ini.filename => .user.ini => .user.ini
variables_order => GPCS => GPCS
xmlrpc_error_number => 0 => 0
xmlrpc_errors => Off => Off
zend.assertions => -1 => -1
zend.detect_unicode => On => On
zend.enable_gc => On => On
zend.multibyte => Off => Off
zend.script_encoding => no value => no value
zend.signal_check => Off => Off

...