Problems with MODx 2.0.7 and php.ini (Bug?)

Here is some output from "info.php", which I FTPed to my
webserver’s root folder (and called directly in my
browser’s address bar):

Server API: CGI
Virtual Directory Support: disabled
Configuration File (php.ini) Path: /usr/lib
Loaded Configuration File: /home/freewhee/public_html/php.ini

farther down in the output I have

Directive Local Master
--------------------------------------
register_argc_argv On On
register_globals Off Off
register_long_arrays On On

So at least according to PHP’s information, it (i.e. PHP) is
using my custom php.ini file. This coincides with my hoster’s
guide to "put the php.ini file in the root folder".

However, MODx 2.0.7 (fresh install, no content added yet)
still spews out the error:

"One or more configuration details didn’t check out OK:
Configuration warning: register_globals is set to ON in
your php.ini configuration file
What does this mean?
This configuration makes your site much more susceptible
to Cross Site Scripting (XSS) attacks. You should speak
to your host about what you can do to disable this setting.
Please contact a systems administrator and warn them about
this message!"

PHP runs as CGI and not as Apache module, but nevertheless
I tried to use .htaccess files (knowing this approach would
probably fail). So I uncommented the line containing

php_flag register_globals Off

renamed the file ht.access to .htaccess and FTPed it to my
server. Sure as day follows night I received a "server
internal error (500 error)".

So my conclusion(s):

- Either MODx 2.0.7 errenously reports this "register_globals" error
- or the report is correct, in which case MODx 2.0.7 does NOT
respect my local php.ini file!

Any comments and (especially) solutions are highly estimated!

Cheers
Mike

MODx cannot "respect" or "not respect" your php.ini settings. This totally depends on your PHP and other server configurations. Your web server sees a .php file and sends it to the PHP interpreter; this is where the php.ini is determined, before the index.php file (and thus MODx starts working) is ever even parsed by the PHP interpreter.

Try putting the info.php file in the directory where the manager’s index.php is, and call it from there. You may find that you need an additional copy of your php.ini file in that directory.

I had to put the location to the php.ini file in the .htaccess file to solve a similar issue.

Eg: suPHP_ConfigPath /home/myaccount/public_html

Don’t know if this would be of any help for you.

This entry in the .htaccess file works because when using PHP as a CGI stand-alone interpreter, whenever Apache sees it’s being given a .php file it makes a system call to invoke the PHP interpreter, passing it the name of the .php file (such as index.php) as a parameter. When this setting is in the .htaccess file, then Apache will pass another parameter with this php.ini location.

-c <path>|<file> Look for php.ini file in this directory

Hi all
thanks for the replies and sorry for the delay in answering!
Here’s what I did:
- Copied my php.info file into the "manager" folder and called it.
I get the following values

Directive Local Master
------------------------------
register_argc_argv On On
register_globals Off Off
register_long_arrays On On

So that seems to help here. I did not test the .htaccess approach
yet (i.e. -c <path>|<file> "Look for php.ini file in this directory").

However, I’m still worried/wondering/curious whether my site is now
"safe". After all, "php.ini inheritance" down the site tree (from
folder "public_html" to "manager") does not seem to work. Do I have
to copy my "php.ini" into every folder that contains php scripts?
Or am I done with "public_html" and "manager"?

Mike

php.ini does not inherit. It must be placed in every folder with executing .php files (in the case of MODx Evolution, that’s the root index.php and the manager/index.php). You don’t need it anywhere else since all the rest of the .php files are included into those, not executed independently.

If you have AJAX processing scripts that are executed independently, then you would indeed need one in the folder with those .php files.

Ah, I see. Okay, thanks a lot for clarifying!

Mike

What happens is that when a file is passed to the PHP interpreter (Apache calls the interpreter with the file as a parameter), it checks the directory the file comes from to see if there is a php.ini file there. If there is, then its entries will override the defaults.

In some cases (it depends on how the server is configured) a directive in the .htaccess file tells Apache to call the PHP interpreter with a parameter to indicate the location of the php.ini file to use as default. In this case, a single full php.ini file in one location will do the trick.

If PHP is an Apache module and not using CGI or FastCGI, then these don’t do anything; Apache can apply the various php_flag and other php-oriented .htaccess directives in its module.