Check if "exec" is disabled

Question

Is there any function in PHP that I can use to detect whether or not the exec function is available?

`echo (int)function_exists('exec');` – Yousha Aleayoub May 26 '17 at 15:06 — Yousha Aleayoub, May 26 '17 at 15:06

Brent · Accepted Answer · 2013-12-05T23:07:15.567

46

<?php
function exec_enabled() {
  $disabled = explode(',', ini_get('disable_functions'));
  return !in_array('exec', $disabled);
}
?>

EDIT: Fixed the explode as per Ziagl's comment.

edited Dec 05 '13 at 23:07

answered Oct 14 '10 at 22:37

Brent

23,354
10
44
49

1

This returns `true` if `exec` is enabled. – Sandeepan Nath Jan 13 '11 at 11:02
1

that's why the function is called exec_enabled, it's just not exactly what he asked for. – Brent Jan 13 '11 at 20:48
3

this might work or it might not - unfortunately, in my case, I found that `ini_get()` was in the list of disabled functions along with `exec` and other file-system functions; a likely scenario, given that hosting providers might be concerned about exposing information in the INI file. – mindplay.dk Oct 23 '13 at 12:49
2

works for me, but only with explode(',' ... instead of explode(', ' ...there are no blanks in ini_get string – Ziagl Dec 02 '13 at 10:19
I had to post process the return of explode with trim to strip off blanks. – Scott C Wilson Oct 04 '17 at 13:23

score 14 · Answer 2 · edited Oct 20 '12 at 00:23

The following function is more robust. It deals with the disabled_functions value having 0 or more spaces between function names, checks the suhosin patch's blacklist setting, covers safe_mode, and stores the answer for future reference.

function is_exec_available() {
    static $available;

    if (!isset($available)) {
        $available = true;
        if (ini_get('safe_mode')) {
            $available = false;
        } else {
            $d = ini_get('disable_functions');
            $s = ini_get('suhosin.executor.func.blacklist');
            if ("$d$s") {
                $array = preg_split('/,\s*/', "$d,$s");
                if (in_array('exec', $array)) {
                    $available = false;
                }
            }
        }
    }

    return $available;
}

For the record, the edit adding the suhosin blacklist check was by me. After submitting it, I realized my authentication session was somehow out of whack. Alas. — Daniel Convissor, Oct 20 '12 at 00:32

svens · Answer 3 · 2010-10-14T23:02:24.947

2

You can search the ini setting disable_functions for the exec() function.

if( false !== strpos(ini_get("disable_functions"), "exec") ) {
 // exec() is disabled

Just for completeness, note that PHP Safe Mode puts some restrictions on the function too.

edited Oct 14 '10 at 23:02

answered Oct 14 '10 at 22:41

svens

11,438
6
36
55

Way too slow as I see :) – svens Oct 14 '10 at 22:42
8

This will return the wrong answer if a function like `shell_exec` has been placed in `disable_functions` but `exec` has not. Best to use explode or regex to make sure it matches a complete function name. – webbiedave Oct 14 '10 at 22:54

score 1 · Answer 4 · answered Nov 11 '11 at 13:44

You also need to check whether safe_mode is active as exec is unavailable if safe_mode is on

function is_exec_available() {

    // Are we in Safe Mode
    if ( $safe_mode = ini_get( 'safe_mode' ) && strtolower( $safe_mode ) != 'off' )
        return false;

    // Is shell_exec disabled?
    if ( in_array( 'exec', array_map( 'trim', explode( ',', ini_get( 'disable_functions' ) ) ) ) )
        return false;

    return true;

}

Lance Cleveland · Answer 5 · 2013-03-13T15:10:02.043

A one-line compilation of safe mode, function exists, and disabled exec using some of the techniques found on various SO posts.

This will check that exec is available and enabled BEFORE trying to run it. If you run exec() and the function does not exist or is disabled a warning will be generated. Depending on the server settings that may render to the browser and will almost-always write a line to a log file = performance hit.

// Exec function exists.
// Exec is not disabled.
// Safe Mode is not on.
$exec_enabled =
     function_exists('exec')                                            &&
     !in_array('exec', array_map('trim',explode(', ', ini_get('disable_functions'))))     &&
              !(strtolower( ini_get( 'safe_mode' ) ) != 'off')
     ;


if ($exec_enabled) { exec('blah'); }

Check if "exec" is disabled

5 Answers5

Linked