0.9.6.2 security problem with reflect snippets

*Think missunderstanding here*

Your method is not a guarantee for register_globals being set OFF he says.

http://modxcms.com/forums/index.php/topic,30850.msg187357.html#msg187357

xpix Only your host can tell you the best way to ensure register_globals is off. Every host can configure PHP installs however they want. Sure PHP 5 ships with register_globals off but there is nothing to stop individual hosts from setting it to on. Forcing the php type to php 5 may or may work depending on your host and the server setup and might do nothing at all. In addition not all servers support using such a flag or offer both versions of php 4 and 5 and it could wind up with unpredictable results and errors.

The best way to ensure register_globals is off is to do one of the 3 following:

1. use the php_flag in the .htaccess that ships with modx to set register_globals to off.
2. Use php.ini files in each of the directories in your installation to set register_globals to off.
3. Call or email your host and tell them to turn register_globals off on your server or on the entire server.

If you can’t ensure it is off with one of the three you should seriously look for a new host.

I found the solution "AddType x-mapp-php5 .php" in the provider’s FAQ page. So I guess it works.
I’ll consider others for hosting from now on.

Quote from: xpix at Dec 12, 2008, 09:20 AM

I found the solution "AddType x-mapp-php5 .php" in the provider’s FAQ page. So I guess it works.
I’ll consider others for hosting from now on.

If that works on your host then that’s perfectly fine. The only important thing is making sure that it’s off. If phpInfo() (viewable within the MODx Manager) says that the local value is off, then you’re all set.

register_globals Off Off

from php info

So I guess I’m ok

Quote from: xpix at Dec 12, 2008, 10:33 AM

register_globals Off Off

from php info

So I guess I’m ok

You’re golden, dude.

Does anyone see a problem with adding a further layer of protection to sites by adding the following rule to htaccess:



Seems that most script kiddie scanners/bots are using some version of the libwww-perl tool so between catching hits on the suspect code in question and the key parameter, this would just drop (403 - Forbidden) those requests.

Is there an advantage to doing that and returning 403 Forbidden over renaming or deleting the file and returning 404 Not Found?

All I know is that once we implemented that on the modx site our server load dropped tremendously.

Quote from: rthrash at Dec 17, 2008, 12:04 PM

All I know is that once we implemented that on the modx site our server load dropped tremendously.

I guess the difference is that MODx handles 404 requests, which is something that I hadn’t considered.