Hi All,
I have been away from MODx for while now...
I am trying to install MODx onto my Hostgator server. I got the database and install to work fine. Once the install was completed I got the dreaded ’register_globals is set to ON in your php.ini configuration file’ warning.
I read about removing the # mark from the line that reads "#php_flag register_globals off" in the ht.access file. This I was able to do. I also read that you need to rename the ht.access file to .htaccess. This is where I ran into problems. I am trying to do this with Leopard. I would get a system warning not to name a file that begins with a "." period. I tried several times and then tried to highlight and rename the ht.access in my FTP session window. The file then disappeared from the window. I then tried copying the file from the MODx download archive to get back where I started but now I can’t get the site to come up. I get a 500 Internal Server Error.
So I think I have really screwed this up. Do I have to purge my folder and install MODx all over again or is there something I can try?
Thanks!
Max
Update:
I turned on the "show invisible files" in my Transport FTP program. I now have one file that is called .htaccess but I am still getting the 500 error when I go to the site...
Fresh update: I tried several things:
If I have this in the .htaccess file: "php_flag register_globals Off" I get the 500 Internal Server Error but if I put the # mark back so it reads "#php_flag register_globals Off" I can view the site.
At least I am back where I started. But going to the manager I still am faced with the "Configuration warning: ’register_globals is set to ON in your php.ini configuration file" message.
Again I am attempting to get this working on Hostgator. I wonder if I need to contact them?
Max
There is a comment in the main .htaccess file that addresses your situation:
# IF REGISTER_GLOBALS DIRECTIVE CAUSES 500 INTERNAL SERVER ERRORS :
#
# Your server does not allow PHP directives to be set via .htaccess. In that
# case you must make this change in your php.ini file instead. If you are
# using a commercial web host, contact the administrators for assistance in
# doing this. Not all servers allow local php.ini files, and they should
# include all PHP configurations (not just this one), or you will effectively
# reset everything to PHP defaults. Consult www.php.net for more detailed
# information about setting PHP directives.
I would expect that Hostigator allows you to upload a local php.ini file, but you’ll need to ask them for more specific instructions.
I did some reading on this and its still as clear as mud to me.
I went to my hostgator cpanel and it looks like my permissions for this folder are 755/644 which is good.
I tried uploading a php.ini file with the words "register_globals off" into the cgi_bin folder and I still get this stupid warning?
Some of the reading I did says that having the permissions set to off is prefered while some say its good to have them set to on. I would just like the warning to go away.
HTML used to be so easy...
You definitely do not want to leave register_globals set to ON. That’s a major security risk. Long ago it was considered a convenience (for sloppy coders), but nowadays I don’t think you’d find anyone who’d say it’s a good thing to leave them set on.
In a php.ini file the syntax is a little bit different, so you should change it to:
register_globals off
or
register_globals 0
Where you should put this file depends upon how your host has set up PHP, so that’s part of the reason that it’s advisable to contact Hostigator (they might just do it for you also).
Thanks,
This quote from a hostgator support guy from another thread:
"Hello,
Almost all php/mysql scripts would work on our servers. If you get the register_globals error it is very easy to fix it. We run phpsuexec and so you need to upload your own php.ini in your script folder with the text :
register_globals off
to have this done."
So, I tried uploading a php.ini file into the root folder for the MODx install and then tried placing it into the cgi_bin folder but still get the register_globals warning...
I want to check the php.ini file: all I have is one line that says: register_globals off
To double check: where does this file go???
Not sure what to do at this point. I feel I cant do any work on this site until I figure this stupid warning out...
On some servers you can’t modify the main php.ini file and any local php.ini file that you upload only works within that folder (not subfolders). So in that case you need to upload a copy of this file to every subdirectory that has files that end in .php (that’s a lot of subfolders, unfortunately). Try uploading it to your manager directory and see if the warning goes away. If it does, then you’re on the right track. To properly safeguard your site, you should upload copies of the same php.ini to every subfolder with PHP files. It’s a pain, but it’s necessary. Ideally Hostigator would just change the main php.ini file, so you could always ask them again...
I got a hostgator guy on the phone with no wait time which really impressed me.
He put me on hold, came back and said all I need to do is add the php.ini file to the Manager folder. While I was on hold I read your last post about adding the file to all folders that contain a php file. He said no, all I need is for the php.ini file to go into the Manager folder.
This I did and voila: no register_globals warning. So, am I safe here or should I add the file to all the folders to be safe? I know there are a ton of folders within folders that contain php files...
I appreciate your kind input on this frustrating puzzle I have been "enjoying" ...
I would add it to all subfolders that have php files. The reason is that this setting (register_globals OFF) is important protection agains XSS (cross-site-scripting) attacks, and many such attacks don’t come in through the front door (say the main index.php file or the one in the manager directory) but rather through some obscure include file shipped with a helper package (such as TinyMCE). So you want to be sure that register_globals is OFF in these subdirectories as well as the main manager folder (which is where MODx checks this, so that’s why the warning disappears if you turn it off there).
Sounds like good advice!
Thanks!
I think this can wait until the morning. I need a beer...
