Change php.ini location...

In order to turn off register_globals in my php.ini, my host has it setup where I can use a local php.ini with the correct values. My problem is, my current install of MODx (0.9.5 RC3) keeps reading the php.ini from the server (path = /usr/local/Zend/etc/php.ini).

Is there a way I can change, or at least append, the location of where MODx looks for the php.ini file?

I don’t think that MODx has any control or affect on the PHP configuration. Perhaps it’s something in your .htaccess file?

Let me rephrase the question...

MODx is automatically reading the php.ini from the server’s default path (/usr/local/Zend/etc/php.ini).

This php.ini file has register_globals turned ON. I need register_globals turned OFF, but I don’t have access to the server’s php.ini.

What my server [host] WILL allow me to do is place a php.ini in the MODx directory which will turn register_globals off. This works, but MODx is not seeing that php.ini file, it’s seeing the default file in the location I specified above.

So, how can I tell MODx where the correct php.ini file is located? If I can do that in the .htaccess, that would be great, but I just need to figure out what the right command to do so would be.

You can’t tell MODx that.
PHP tells MODx that.

-sD-

A quick search on Google revealed the following page. See the section "what if you don’t control the server":

http://www.nyphp.org/phundamentals/ini.php

Note that the problem you are describing is a server/PHP/Apache issue, not a MODx issue.

Andy

Thanks, Andy. That added the fuel I needed to get this solved.

So, the solution I have to use, which is the only solution that worked for me so far, is my host allows for use of a local php.ini file. I placed this file in the root MODx directory, but MODx was still seeing the Global php.ini file. I then had to move my local php.ini file to the /manager directory and add the following lines to the php.ini:



Now when I log into the MODx manager, the warnings for register_globals have gone away. When I pull up the phpinfo (REPORTS --> SYSTEM INFO --> phpinfo() VIEW), it shows MODx to be reading from my local php.ini file.

My new question is this: Does turning off register_globals in the /manager directory suffice in securing MODx as a whole?

The reason I asked this is my host says when I use a local php.ini file, it is only good for the specific directory that the php.ini sits in (e.g. it’s not recursive). So, what areas of MODx am I trying to secure and stop register_globals from affecting? Did I only fool the MODx Manager into thinking register_globals is completely off for the whole site?

You need to add it to every single folder.

Quote from: rthrash at Dec 07, 2006, 11:54 AM

You need to add it to every single folder.

Really? That’s going to suck having to make sure there’s a php.ini folder in every spot throughout the site. Especially is subfolders get added by another user and I don’t know about it.

Guess I’m going to have to plead with the host to turn it off globally.

Thanks, Ryan!

Hosting is one of my pet peeves; you frequently get exactly what you pay for.