register_globals

200 Posts

modxlearner123 Reply #1, 16 years, 10 months ago

ok I had started another thread asking others to look at my .htaccess file, and no replies, either way the installation went almost flawlessly, everything works, the host runs php as a cgi, so I didn’t even use the .htaccess file, but used the text to create a small php.ini file, because the host specifically asked that the whole php.ini file not be used.

php() says registered globals are still on, even though I removed the # tag...plus do I have to put each directory for RewriteBase (gosh what a nightmare)I already have CTS from so many ctrl-x and v’s embarrassed

or leave as is? what else is lacking, this is the first php.ini I have created and with the help of obscure blogs across the internet, with exception of my email issue, I have been able to do this without asking TOOOOOO many questions.
should I add AddType x-mapp-php5 .php for those scripts? the host is still running php4 but those scripts were present for 4 weren’t they....not a php guru by any means hence the need for modx.

heres the php.ini file:

[PHP]

php_flag register_globals Off
#AddDefaultCharset utf-8
#php_value date.timezone America/Chicago

Options +FollowSymlinks
RewriteEngine On
RewriteBase /

# Fix Apache internal dummy connections from breaking [(site_url)] cache
RewriteCond %{HTTP_USER_AGENT} ^.*internal\ dummy\ connection.*$ [NC]
RewriteRule .* - [F,L]

# Rewrite domain.com -> www.domain.com -- used with SEO Strict URLs plugin
#RewriteCond %{HTTP_HOST} .
#RewriteCond %{HTTP_HOST} !^www\.example\.com [NC]
#RewriteRule (.*) http://www.example.com/$1 [R=301,L]

# Exclude /assets and /manager directories from rewrite rules
RewriteRule ^(manager|assets) - [L]

# For Friendly URLs
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ index.php?q=$1 [L,QSA]

# Reduce server overhead by enabling output compression if supported.
php_flag zlib.output_compression On
php_value zlib.output_compression_level 5

once dem globals are turned off, that’s it....and yes I have scroogled like crazy, but everything says to essentially add the comment as far as writing a php.ini file for a cgi based host, well my eyes are bleeding from trying.

4,205 Posts

dev_cw Reply #2, 16 years, 10 months ago

In the few instances where I needed a php.ini file to disable register_globals all I add is one line:

register_globals = off

The remaining rewrite rules should remain in a .htaccess file.

In some servers (I think that GoDaddy is like this) you will need to add a php.ini file in every directory that processes php scripts, but I have never run into this scenario.

[font=Verdana]Shane Sponagle | [wiki] Snippet Call Anatomy | MODx Developer Blog | [nettuts] Working With a Content Management Framework: MODx

Something is happening here, but you don't know what it is.
Do you, Mr. Jones? - [bob dylan]

200 Posts

modxlearner123 Reply #3, 16 years, 10 months ago

thanks for the prompt reply, yes I have to add the php.ini to every single folder and sub-folder, that’s been taken care off, but I can’t use the .htaccess file because if both the php.ini file and .htaccess file is present there is a server error, .htaccess isn’t allowed on their servers when php is running as a cgi and not an apache module.

I have whipped off an email but the thought of an unsecured php site sitting wide open overnight worries me a bit.

the host is 1&1 but the posts I have come across don’t necessarily address the issues, thought perhaps there was something else I was doing wrong, especially with the rewrite base part...since I am not very familiar with php other than basic scripts. i.e. footer dates etc. sad I know, but as I have said I am a designer, and though I have tons of experience with xhtml and css and static site deployment, when it comes to php I am still in diapers.

for example, in the two areas with example.com do I change that to my clientsite.com?

4,205 Posts

dev_cw Reply #4, 16 years, 10 months ago

I have whipped off an email but the thought of an unsecured php site sitting wide open overnight worries me a bit.

Good thinking, but this should not be a serious problem for a short time.

What is the server error? It might not be related to having both the php.ini and htaccess file on the same server.

Here are the docs from 1&1 on disabling register_globals on their servers. There is also this bit that you mentioned about adding the line AddType x-mapp-php5 .php in order to use php5 as the default php version on shared servers.

[font=Verdana]Shane Sponagle | [wiki] Snippet Call Anatomy | MODx Developer Blog | [nettuts] Working With a Content Management Framework: MODx

Something is happening here, but you don't know what it is.
Do you, Mr. Jones? - [bob dylan]

200 Posts

modxlearner123 Reply #5, 16 years, 10 months ago

server error 500 but only when I had either the .htaccess with that bit of script for compatibility added or both php.ini and .htaccess installed in the root directory, with just php.ini, the install went fine. I tried three times, one, with just .htaccess. one with both and one with just the php.ini....

guess I have to see what they say, that bit about it not being a worry for the short term has me relaxed a bit, security is a big deal to me, I use my winmachine strictly for designing workflow and my linux boxes for everything else, so much so, I knew how to chmod 777 directories in linux and not in windows, I think the last time I used dos was for oregon trail in fifth grade! laugh

Then it occured to me that nix rules don’t apply anyway...

but those two lines with example.com need to be changed to clientsite.com? to help make the site more url friendly or just keep the url friendly settings in the manager? I know that’s unrelated to globals, just thought I’d take advantage laugh

will add the line to php.ini for compatibility, I just didn’t think those scripts were unique to php5

thanks a bunch!!

76 Posts

twz-17 Reply #6, 16 years, 10 months ago

The server error 500 is probably not caused by having both php.ini and .htaccess files - but by having php settings inside the .htaccess file. You should be able to use .htaccess for rewriting, and php.ini for php settings. And as dev_cw pointed out, the correct format in php.ini is register_globals = off

You can also have one php.ini that applies to all folders, by putting this in your .htaccess:

SetEnv PHPRC /home/myusername/public_html/subdir

then the php.ini in that directory will apply to your whole site.

4,205 Posts

dev_cw Reply #7, 16 years, 10 months ago

but those two lines with example.com need to be changed to clientsite.com? to help make the site more url friendly or just keep the url friendly settings in the manager? I know that’s unrelated to globals, just thought I’d take advantage Cheesy

The 500 error can be related to a misconfiguration in the seo friendly setting in the htaccess file. In the htaccess file included with 1.0.2 you dont need to edit the lines with example.com unless you are using the SEO strict plugin, it is not part of the default installation.

I had 500 errors in my last project, the solution was to comment out the "Options +FollowSymlinks" line:

# Options +FollowSymlinks

[font=Verdana]Shane Sponagle | [wiki] Snippet Call Anatomy | MODx Developer Blog | [nettuts] Working With a Content Management Framework: MODx

Something is happening here, but you don't know what it is.
Do you, Mr. Jones? - [bob dylan]

200 Posts

modxlearner123 Reply #8, 16 years, 10 months ago

great! I am going to give that a try and thanks to both of you!!

200 Posts

modxlearner123 Reply #9, 16 years, 10 months ago

I sent the .htacess with all the php left commented out and put the one register_globals line and AddType x-mapp-php5 .php for good measure in the php.ini file, and no server error! that’s a start, but I installed without a .htaccess file, that’s not a problem is it, while I am asking?

the php info is still saying globals on, so I will do another cut and paste marathon tomorrow to get it into all the hundreds of directories, because right now, I just put php.ini into root, manager, includes and assets...

guess the host will have a thing or two to say about it...(I hope)

thanks guys, that was a HUGE eye opener on the roles of .htaccess and php.ini

200 Posts

modxlearner123 Reply #10, 16 years, 10 months ago

geez I feel stupid!!! >:( I had been confused by so much I had seen in preparation for the install, even some archived posts here regarding cgi and module servers, and one and one’s own outdated info regarding .htaccess on module servers and php.ini on cgi servers.

as for now one and one require this, haven’t heard back from their last response which I deleted here because it confused me even more!! they didn’t mention deleting the php.ini file or those in the subdirectories, but I did and left just htaccess as follows:

AddType x-mapp-php5 .php 
#php_flag register_globals Off
#AddDefaultCharset utf-8
#php_value date.timezone Europe/Moscow

Options +FollowSymlinks
RewriteEngine On
RewriteBase /

# Fix Apache internal dummy connections from breaking [(site_url)] cache
RewriteCond %{HTTP_USER_AGENT} ^.*internal\ dummy\ connection.*$ [NC]
RewriteRule .* - [F,L]

# Rewrite domain.com -> www.domain.com -- used with SEO Strict URLs plugin
#RewriteCond %{HTTP_HOST} .
#RewriteCond %{HTTP_HOST} !^www\.example\.com [NC]
#RewriteRule (.*) http://www.example.com/$1 [R=301,L]

# Exclude /assets and /manager directories from rewrite rules
RewriteRule ^(manager|assets) - [L]

# For Friendly URLs
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ index.php?q=$1 [L,QSA]

# Reduce server overhead by enabling output compression if supported.
#php_flag zlib.output_compression On
#php_value zlib.output_compression_level 5

now register globals is showing off, thanks again guys!