[SOLVED] Configuration warning: 'register_globals is set to ON in your php.ini

I took this site over about 18 months ago and the warning message has always been there. Recently I needed to do some major changes so I had to read up on MODx.

I can not turn this off through .htaccess because server is CGI. I have tried putting php.ini in all folders but still no luck. In the file I put only the following:



I have checked phpinfo() and found:

/usr/local/Zend/etc/php.ini

but I can not find that location on the server.

I am running on a Zeus server - Linux.

Anyone got any further suggestions?

Keith

try

Sinbad

Thanks for that but did not work.

I have checked this forum and I am starting to wonder whether this is to do with Zeus server. If that is the case perhaps I should take it up with hosting company which is Namesco.

Is it important that I get them set to off.

Keith

I’ve now found this on Namesco FAQ:

The value of register_globals is set to on in the PHP installations on our Linux cluster.

This value is, however, not recommended. No script should ever rely on register_globals to be enabled, as this can lead to scripts being exploited. The default installation value is now set to off when PHP is installed.

However, after an audit of scripts and looking at coding practices, there are far too many scripts that incorrectly rely on this directive being enabled. Disabling it at present would present a logistical headache, as any script that relies on it being enabled would have to be debugged and rewritten correctly.

While this is currently enabled, there may be a point in the near future where we will disable this directive, as recommended by the authors of PHP.

Have you tried putting a php.ini file in the MODx root with this:

register_globals = off

For some hosts, you’d put that file in the /cgi-bin directory

Bob

I’ve just tried your code which is different to what I originally used. Also it looks slightly different to sinbad’s code with regards the o of off.

I’ve put it in root plus manager and asset folders but I still have warning.

With this hosting I do not appear to have a cgi-bin directory.

I took this site over about 18 months ago and until recently have not had to do much to it. The warning has been there from the start. As I am getting more into MODx I thought I would try and solve it.

Keith

I’d recommend going to the hosts forum (assuming that there is one), and doing a search for register_globals.

The next step after that would be a message to support asking them how to turn it off for your domain (perhaps with a polite threat to change hosts).

If there’s really no way to do it, I’d change hosts if it’s at all possible.

Hi Keith,

I would follow BobRay’s advice I’m sure if you contact them they can apply the setting to a specific site, our web hosting servers run PHP in FastCGI Mode which prevents users from having a site specific php.ini but we can enable rules per domain when customers request.

Fingers crossed they can fix it for you.

Aaron

Bob and Aaron

Thanks for the input I have raised a support enquiry with Namesco.

I was reading about One Smart Host and the good service yesterday.

Keith

I have had the following reply from Namesco:

We can move your site to PHP 5 which will have register_globals off by default however you will need to ensure you have a copy of your sites files before we do this. Please ensure you have a backup of your site then reopen this ticket requesting that you move to PHP 5.

Any advice from anyone? Are there any potential problems?

Is there a backup procedure that I should follow?

Keith