I don't disable risky php functions directly via php.ini - I do so via suhosin (which can have its configuration in php.ini of course, but....).

So my feature request is for ASL to take this into account and not display warnings that functions X Y or Z are enabled when in fact they are disabled.

Faris.

just out of curiosity, why do it in suhosin when the php.ini already has the disable functions line in it - is there a difference in performance?

I do it because it allows me to re-enable any of those functions on a per-vhost basis in vhost.conf and gives me a good, obvious error when someone tries to use a disabled function.

I can't quite remember why I went this route. I suspect it has something to do with my various 4psa utilities. They would not work when certain functions were disabled directly in PHP but I somehow got around this by doing it in suhosin. I can't for the life of me figure out how I might have done this though. Errr....I really should make better notes when I'm doing this kind of thing!