Answers.Body: <p>Craft uses MySQL's native <a href="https://dev.mysql.com/doc/refman/8.0/en/mysqldump.html" rel="nofollow noreferrer">mysqldump</a> and PostgreSQL's <a href="https://www.postgresql.org/docs/10/static/app-pgdump.html" rel="nofollow noreferrer">pg_dump</a> binaries to create database backups.</p>
  
  <p>In order for PHP to be able to execute those binaries, it needs to be able to run the <code>proc_open</code> and <code>proc_close</code> PHP commands.</p>
  
  <p>I would not consider it a security issue, but if you were really concerned about it, you can <a href="https://docs.craftcms.com/api/v3/craft-config-generalconfig.html#$backupOnUpdate-detail" rel="nofollow noreferrer">prevent Craft from making backups on update</a> and/or specify your own <a href="https://docs.craftcms.com/api/v3/craft-config-generalconfig.html#$backupCommand-detail" rel="nofollow noreferrer">backup logic</a> bypassing Craft's default implementation.</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-09-26T20:10:23.220Z
Answers.Text: How did Craft 2 do it? Craft 2 worked flawlessly with openbasedir, Craft 3 does not.
Answers.UserDisplayName: Anders
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-10-05T22:04:13.077Z
Answers.Text: Not sure what this post has to do with openbasedir?
Answers.UserDisplayName: Brad Bell
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-10-06T01:46:41.387Z
Answers.Text: openbasedir disables proc_open(), no? That seems to be how shared hosting typically works in any case.
Answers.UserDisplayName: Anders
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2018-10-06T08:29:24.413Z
Answers.Text: Ahh, a host that might use openbase_dir, might also happen to disable some proc_ methods, but they are technically unrelated.
Answers.UserDisplayName: Brad Bell
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2018-04-30T23:57:17.020Z
Answers.LastActivityDate: 2018-04-30T23:57:17.020Z
Answers.UserDisplayName: Brad Bell
Body: <p>Why do I have to activate the PHP functions: &quot;proc_open&quot; and &quot;proc_close&quot; to backup the database?</p>
  <p>I got the error logs:</p>
  <blockquote>
  <p>[error][yii\base\Exception] yii\base\Exception: Could not create backup: proc_open() has been disabled for security reasons in /home/velolade/craft3veloladen_daten/vendor/craftcms/cms/src/controllers/UtilitiesController.php:383</p>
  <p>[error][yii\base\Exception] yii\base\Exception: Could not create backup: proc_close() has been disabled for security reasons in /home/velolade/craft3veloladen_daten/vendor/craftcms/cms/src/controllers/UtilitiesController.php:383</p>
  </blockquote>
  <p>After activating these functions in my hoster's PHP settings, it worked.
  Is this a security problem for my website?</p>
  <p>Thank you very much!</p>
  
Tags: <craft3><database><security><back-up>
Title: Craft 3 Database Backup
ThreadText: # Craft 3 Database Backup
  
  (Asked by: username_0 on 2018-04-27)
  
  Why do I have to activate the PHP functions: "proc\_open" and "proc\_close" to backup the database?
  
  I got the error logs:
  
  > [error][yii\base\Exception] yii\base\Exception: Could not create backup: proc\_open() has been disabled for security reasons in /home/velolade/craft3veloladen\_daten/vendor/craftcms/cms/src/controllers/UtilitiesController.php:383
  >
  > [error][yii\base\Exception] yii\base\Exception: Could not create backup: proc\_close() has been disabled for security reasons in /home/velolade/craft3veloladen\_daten/vendor/craftcms/cms/src/controllers/UtilitiesController.php:383
  
  After activating these functions in my hoster's PHP settings, it worked.
  Is this a security problem for my website?
  
  Thank you very much!
  
  **Tags:** craft3, database, security, back-up
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2018-04-30. Score: 2 | Accepted answer
  
  Craft uses MySQL's native [mysqldump](https://dev.mysql.com/doc/refman/8.0/en/mysqldump.html) and PostgreSQL's [pg\_dump](https://www.postgresql.org/docs/10/static/app-pgdump.html) binaries to create database backups.
  
  In order for PHP to be able to execute those binaries, it needs to be able to run the `proc_open` and `proc_close` PHP commands.
  
  I would not consider it a security issue, but if you were really concerned about it, you can [prevent Craft from making backups on update](https://docs.craftcms.com/api/v3/craft-config-generalconfig.html#$backupOnUpdate-detail) and/or specify your own [backup logic](https://docs.craftcms.com/api/v3/craft-config-generalconfig.html#$backupCommand-detail) bypassing Craft's default implementation.
  
  > **Comments:**
  > **username_2**: How did Craft 2 do it? Craft 2 worked flawlessly with openbasedir, Craft 3 does not.  
  > **username_1**: Not sure what this post has to do with openbasedir?  
  > **username_2**: openbasedir disables proc_open(), no? That seems to be how shared hosting typically works in any case.  
  > **username_1**: Ahh, a host that might use openbase_dir, might also happen to disable some proc_ methods, but they are technically unrelated.  
  
  ---
  
  