1

We recently had one of our many Joomla websites fail a PCI compliance test, and our network folks are now telling us that we must "disable file_get_contents". As best as I can tell, it would be about the same as disabling PHP in terms of the effect that it would have on a Joomla site. I speak network-ese as well as my high school french, so can't come up with any viable alternatives, aside from suggesting permission changes to Apache.

We're running WAMP and XAMPP on our Windows servers (depending on how old the site is as we gradually get them all from 1.5 to 3.x). We have RSFirewall installed on all/most sites, as well as mod_security and various htaccess settings, but apparently that didn't stop the test from gaining access to files that they shouldn't have.

Is there a minimal, or "safest", set of permissions/settings that are Joomla-friendly which I can suggest to them that might limit the reach of file_get_contents as an alternative to simply disabling it altogether?

Improve this question
5
  • I read that you will need to have the 'openssl' extension turned on if you are going to use the 'file_get_contents' function to read from a secure protocol. So in case file_get_contents is/gets disabled, you can use a CURL extension. Not sure if this helps or not though?
    – jonboy
    Commented Sep 5, 2014 at 14:55
  • thx....not sure if it helps or not....I don't really understand all these facets of things, and am trying to formulate an alternative to rewriting the 130+ uses of file_get_contents in the site such as in com_languages: $contents = file_get_contents($filename);.
    – GDP
    Commented Sep 5, 2014 at 15:05
  • Maybe you need to use curl: stackoverflow.com/questions/3979802/alternative-to-file-get-contents
    – Farahmand
    Commented Sep 5, 2014 at 18:02
  • That would involve hacking 100+ lines of core Joomla code - certainly not optimal. i'm hoping for a permission setting that would somehow limit where the file_get_contents would be allowed.
    – GDP
    Commented Sep 5, 2014 at 18:38
  • You can redefine file_get_contents and implement curl function by using override_function in your /index.php and /administrator/index.php files.
    – Farahmand
    Commented Sep 6, 2014 at 7:19

1 Answer 1

Reset to default
0

Not sure that this is the best way, but it allowed us to be PCI compliant:

  1. Applied a Deny permission of only “Write” to C:\ for our Apache user account.
  2. Then set an Allow permission of “Full Control” for the C:\wamp folder.
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.