&reftitle.runtime; &extension.runtime;

# IMAP &ConfigureOptions;

&Name; | &Default; | &Changeable; | &Changelog;
imap.enable_insecure_rsh | "0" | `INI_SYSTEM` | Available as of PHP 7.1.25, 7.2.13 and 7.3.0. Formerly, it was implicitly enabled.

&ini.php.constants; &ini.descriptions.title;

`imap.enable_insecure_rsh` `bool`

- Establishing a connection to a server may invoke `rsh` or `ssh` commands, unless this &php.ini; option is disabled.

  Neither PHP nor the IMAP library filter mailbox names before passing them to `rsh` or `ssh` commands, thus passing untrusted data to this function without disabling this &php.ini; option is insecure.