Kloxo

All setting for 'Advanced PHP Config' was save in .htaccess in domain root directory in '<Ifmodule mod_php4.c></Ifmodule>' and '<Ifmodule mod_php5.c></Ifmodule>'.

I use suPHP on the server and the settings in .htaccess are irrelevant. Something else is wrong.

Related to #435 and #590.

Can you give specific examples of the settings that break it? Also can you create a new user and replicate this issue?

Look inside /usr/local/lxlabs/kloxo/httpdocs/htmllib/lib/pserver/phpinilib.php

function getExtraList()
{
    global $login;
    $list[] = 'sendmail_from';
    $list[] = 'enable_dl_flag' ;
    $list[] = 'output_buffering_flag' ;
    $list[] = 'register_long_arrays_flag' ;
    $list[] = 'allow_url_fopen_flag'; 
    $list[] = 'allow_url_include_flag'; 
    $list[] = 'register_argc_argv_flag' ;
    $list[] = 'magic_quotes_gpc_flag' ;
    $list[] = 'mysql_allow_persistent_flag' ;
    if ($login->isAdmin()) {
        $list[] = 'disable_functions';
        $list[] = 'max_execution_time_flag';
        $list[] = 'max_input_time_flag';
        $list[] = 'memory_limit_flag';
        $list[] = 'post_max_size_flag';
        $list[] = "upload_max_filesize";
    }
    $list[] = 'file_uploads_flag' ;
    $list[] = 'magic_quotes_runtime_flag' ;
    $list[] = 'magic_quotes_sybase_flag' ;
    $list[] = 'cgi_force_redirect_flag' ;
    $list[] = 'safe_mode_flag' ;
    //$list[] = 'session_autostart_flag' ;
    $list[] = 'session_save_path_flag' ;

    return $list;
}

Parameters like 'disable_functions' only could edited by admin. No effect if edited by client.

Yes, that is my mistake. I should have taken measures what to do with the unsubmitted parameters the non-admin users. The idea was a bit too simplistic. For now the work around is to change this:

if ($login->isAdmin()) {
   $list[] = 'disable_functions';
   $list[] = 'max_execution_time_flag';
   $list[] = 'max_input_time_flag';
   $list[] = 'memory_limit_flag';
   $list[] = 'post_max_size_flag';
   $list[] = "upload_max_filesize";
 }

into

$list[] = 'disable_functions';
 $list[] = 'max_execution_time_flag';
 $list[] = 'max_input_time_flag';
 $list[] = 'memory_limit_flag';
 $list[] = 'post_max_size_flag';
 $list[] = "upload_max_filesize";

I guess that everybody agrees that the domain account user should not be able to change the limits I excluded for them, right?

Because this is pretty urgent, you can apply a patch to this file. Since attachments still don't work here for me (I am apparently the only one suffering this) you will need to use this link to get the patch straight from SVN.