On Wed, Feb 19, 2014 at 12:19 PM, <php1@xxxxxxxxxxxxxx> wrote: > Hi all, > > I use php5.4.4, I need disable using of any mail command from my hosting, > so I'm not sure if is sufficiently put "mail" to disable_functions in > php.ini: > > disable_functions = mail > > I want force obligatorily use of smtp authentication > > Is it enough disable "mail"? or do I need add other command to > disable_functions? > > i.e.: using joomla I see: phpmail and sendmail > > thanks for help! > > Pol > > > -- > PHP General Mailing List (http://www.php.net/) > To unsubscribe, visit: http://www.php.net/unsub.php > > Disabling mail() method will not allow anyone to use the mail() method on php. Sendmail on the other hand is what mail() uses to send out the emails (depending on the configs). Users (depending on what other functions you have disabled) can directly execute sendmail program. You can either block all exec style php functions, disable sendmail (by setting permissions to root) or removing it altogether. Exec functions are (I might have forgot one, someone can add to it): exec,passthru,shell_exec,system,proc_open,popen,curl_exec,curl_multi_exec,popen This is assuming you don't have a sendmail alternative installed. Aziz
