[SOLVED] GoDaddy: register_globals set to ON in your php.ini configuration file

So I’m getting this warning in the manager area:

Configuration warning: ’register_globals is set to ON in your php.ini configuration file’

What does this mean?
This configuration makes your site much more susceptible to Cross Site Scripting (XSS) attacks. You should speak to your host about what you can do to disable this setting.

I’m running MODx 0.9.6...

Any ideas how to fix this? I called the hosting (shared hosting on Godaddy.com) and they said it’s nothing they can configure.

Can you turn it off via a custom directive in .htaccess, or are you on their windows hosting platform?

Can you turn it off via a custom directive in .htaccess, or are you on their windows hosting platform?

I’m on Linux...beyond that, I’m not sure how to modify the .htaccess file...

If you look in the root folder where MODx is installed you should have a either an .htaccess file an ht.access file or both. If you changed the default MODx ht.access file to enable Friendly urls there should be a line in there that says:

#php_flag register_globals Off

It should be at or around line 73.

If you remove the "#" and rename the file to .htaccess this should do the trick. UNLESS you are on a server that runs php as a CGI application or in what is calles suExec and in which case this won’t work and you will have to disable register_globals in a php.ini file but try the .htaccess first and get back to the forum.

All the best,

Jay

Thank you for everyone’s input.

Smashingred, you said:

If you look in the root folder where MODx is installed you should have a either an .htaccess file an ht.access file or both. If you changed the default MODx ht.access file to enable Friendly urls there should be a line in there that says:

#php_flag register_globals Off

It should be at or around line 73.

I am able to access the files via the file manager and FTP. I renamed the ht.access to .htaccess (in the Manager folder as well) and set the permissions to 777 to enable FURL. You say I need to look in the .htaccess file for the the lines of code you mentioned. My question is now, how do I do that? I’m a complete newbie I’ll admit! How do I open files like that?

Thanks!

Depending on what ftp client you have you should be able to right click and select edit (this can be done in Notepad or any other text editor BUT you may have to rename the file because some low end text editors will not save witout the txt file extension I’d recommend something better). Personally for FTP I use Filezilla but HTML-KIT, Dreamweaver and UltraEdit and some other editing suites have FTP built in.

Once you open this you will be able to find the lines of code.

Honestly this is a very simple part of learning how to set up and install a CMS and is very common. You should look at learning a little about remote file editing.

Let me know if you are still stuck.

Jay

Hey Smashingred,

Thank you for your input and help. I tried your approach by downloading the .htaccess file onto my computer, renaming it to ht.txt and then edited line 73, #php_flag register_globals Off, by removing the "#". I then saved it, changed it back to .htaccess, uploaded it and this crashed the whole site. I was able to change it back to the original settings on line 73, and now the site is fine.

Am I still doing something wrong?

Thanks again for your help on this.

Did it crash the whole site or did you receive an Internal Server Error 500 from Apache? A blank screen? Which? Did you change anyother settings in the htaccess? Is there another file with the .htaccess in the root of your web directory? Let me know.

:)

Jay

Hey Smashingred,

I got this message for the entire site when I made that change:

Internal Server Error
The server encountered an internal error or misconfiguration and was unable to complete your request.

Please contact the server administrator, [email protected] and inform them of the time the error occurred, and anything you might have done that may have caused the error.

More information about this error may be available in the server error log.

Apache/1.3.33 Server at rent2ownhomesonline.com Port 80

Hope that sheds some light on the problem.

Internal server error (usually 500) on a server running PHP after you have added a php_flag directive to your .htaccess file almost always means that your webhost is running PHP as fastCGI instead of as an Apache module.

If you are have never worked with PHP running as CGI instead of as an Apache module, here are the primary differences (generally speaking):

1. PHP sees file paths the same way you do when you ftp into your account. The root directory "/" is your home directory as far as PHP is concerned.

2. PHP scripts run with YOUR permissions instead of the permissions of the webserver. This is an advantage because your PHP scripts will be able to fopen() files, fwrite() to them and fclose() them at will. This also means the PHP copy() function is totally unrestricted. Any file written by PHP will be owned by you, not the webserver, which means you can then manipulate those files with other PHP scripts.

3. You will often have complete control of your own php.ini file. You can use this to set include_path, auto_prepend_file, register_globals, and other values. You cannot set any php configurations with php_value directives in .htaccess files.

5. A few PHP functions, like getallheaders(), will not work when running as cgi. However, there are always alternatives to achieve the same effect. Other PHP abilities like HTTP Authentication and sending 401 Unauthorized headers are still possible.

I bet if you contact your web host they will confirm that PHP is running as CGI, and they may be able to give you instructions on how to customize a php.ini file for your folders with register_globals set to off.

Definitely check with your host.

-sD-
Dr. Scotty Delicious, Scientist DFPA.