How do I turn off the register_globals error?

Hi,

I’ve installed MODx on my client’s website, and he’s freaking out because of the following warning that shows up whenever either of us logs in:
--
Configuration warning: ’register_globals is set to ON in your php.ini configuration file’

What does this mean?
This configuration makes your site much more susceptible to Cross Site Scripting (XSS) attacks. You should speak to your host about what you can do to disable this setting.
--

The problem is, I’ve installed check_info.php on my server, and it says that both locally and the mater value are set to "Off" already. So I have no idea why the manager is producing this warning, nor how to turn it off. I need to put my client’s mind at ease - can you please explain how I can remove this warning?

Thanks!

Okay, this is weird. Within the manager, I ran check_info.php and it’s saying that register_globals IS on. Where on earth is the php.ini file that the manager is referencing? My web server doesnt’ automatically come with one, and I uploaded one into my root directory that contains this:



and, furthermore, the check_info.php file that is sitting in the same root directory says that register_globals is off.

Any clarification on this issue is greatly appreciated.

Is this your own server? Or is your site hosted by a hosting provider? Is this a Windows, Linux/Unix, or Mac server? Also, the phpinfo (check_info.php??) should tell you what the location of the php.ini file is. Now...if this is your own server I would edit the php.ini file and turn off register_globals. Else, if it’s a hosting provider and it’s running a Linux/Unix derivative you might be able to turn it off via the .htaccess file in the root of the site. There should be a line that you can uncomment to turn it off. However, it’ll depend on whether your hosting provider allows you to modify PHP settings via htaccess files.

Hope this helps!

Jeff

Okay, here’s the dillio. I think my commercial webhost doesn’t allow me to access my php.ini file directly. They mentioned creating one and putting it into my local directory - which works fine when I run check_info.php, because while it’s referencing a php.ini file elsewhere, it recognises the one in the local directory which has register_globals set to off. I know this because when I delete the local one, the register_globals setting goes back to On.

However, the php.ini file that the manager is referencing is obviously the higher-level one, not the local one. So how do I point the manager to the local php.ini file instead?

Thanks!

You have to put local php.ini files in every directory I think.

Ryan is right. Most servers that are set to reference local php.ini files will need to see one in each of the parent folders in question. My host is one that requires this. In addition, if you want to turn on zlib compression you may also have to do it in there instead of in .htaccess. I believe this is because some hosts set up PHP using CGI vs the Apache Handler. I am not sure on the reason but suffice it to say you will need to add the php.ini file to each main directory. In the case of MODx I have found that you really need one in /manager and /manager/includes.

Hope this helps.

Jay

Thaaat’s the missing piece! The one thing I couldn’t find anywhere else - thanks so much! Worked perfectly