curl enable - security risk?

Hello there.

In my php.ini file i have:

disable_functions = exec,passthru,shell_exec,system,proc_open,popen,curl_exec,curl_multi_exec,show_source

Code (markup):

For some script that i would like to use (weather plugin, and one RSS script) i need curl enabled, so i guess that i should just remove "curl_exec,curl_multi_exec" code from php.ini file. I was told that it would be a security risk to do so, and i'm not sure if thats correct?

I'm using CentOS if that matters.

Regards,
Dzonny

 

You are going to break a lot of scripts if you block curl functions. If you are worried about getting hacked by PHP functions, then you need to have your server properly secured.

 

curl is blocked now, so that's why those scripts which i need don't work i guess.
Can you please be more specific about server security about i should pay attention to?

Thanks.

 

Most of the script which runs on perl need curl to be enabled, for example filehosting script need curl enabled!

 

If curl is must for your web site then you can enable specific to that web site keeping server wide disabled.
You can enable curl by adding it in php.ini file in web root of your web site

 

Correct, leaving curl disabled will break many scripts.