How to restrict file system access in PHP? -

someone knows trick have php script self-restrict access file system (fopen, file_get_contents etc.)?

such calls should blocked except handful of selected file names (log file, access /tmp , similar).

this not security thing, rather means of forcing development team not access file system directly (and detect spots in existing code, case). want see exception in case (which gets caught , reported), content of such files must accessed other means.

i thinking implementing own streamwrapper file:// protocol, apparently there no way extend built-in filewrapper class.

option #1

you can use open_basedir php.ini directive limit directories app has access too. directories can semicolon separated can list directories want app access including /tmp folder.

the caveat affects things include, require.

option #2

you rename them using rename_function or runkit_function_rename , wrap renamed versions own logic.

quote documentation:

renames orig_name new_name in global function table. useful temporarily overriding built-in functions.

example:

rename_function('file_get_contents', 'nouse_file_get_contents');  function file_get_contents($filename, $use_include_path = false, $context, $offset = -1, $maxlen) {     //     // validation here     //     return nouse_file_get_contents($filename, $use_include_path, $context, $offset, $maxlen); } 

option #3

you setup coding standards devs , write unit tests run part of deployment before things pushed production. not sure release procedures these types of things should caught before production.