Lockdown of the logging directives

This is done to prevent an attacker who obtained arbitrary code execution to mess with the logging configuration.
jvoisin · Jun 7, 2020 · e9ca6c3 · e9ca6c3
1 parent c709d4f
commit e9ca6c3
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/config/default.rules b/config/default.rules
@@ -138,3 +138,8 @@ sp.disable_function.function("curl_setopt").param("option").value("81").drop().a
 #File upload
 sp.disable_function.function("move_uploaded_file").param("destination").value_r("\\.ph").drop();
 sp.disable_function.function("move_uploaded_file").param("destination").value_r("\\.ht").drop();
+
+# Logging lockdown
+sp.disable_function.function("ini_set").param("varname").value_r("error_log").drop()
+sp.disable_function.function("ini_set").param("varname").value_r("error_reporting").drop()
+sp.disable_function.function("ini_set").param("varname").value_r("display_errors").drop()