We recently had one of our many Joomla websites fail a PCI compliance test, and our network folks are now telling us that we must "disable file_get_contents". As best as I can tell, it would be about the same as disabling PHP in terms of the effect that it would have on a Joomla site. I speak network-ese as well as my high school french, so can't come up with any viable alternatives, aside from suggesting permission changes to Apache.
We're running WAMP and XAMPP on our Windows servers (depending on how old the site is as we gradually get them all from 1.5 to 3.x). We have RSFirewall installed on all/most sites, as well as mod_security and various htaccess settings, but apparently that didn't stop the test from gaining access to files that they shouldn't have.
Is there a minimal, or "safest", set of permissions/settings that are Joomla-friendly which I can suggest to them that might limit the reach of
file_get_contents as an alternative to simply disabling it altogether?