register_globals

Ok, I know there are many threads on this but I still haven't found a solution.

The problem is I get a 500 error when trying to turn register_globals Off. My web host is MacHighway so if anyone has experience with (or solved) this issue on their servers I would like to know how.

First I tried uncommenting this line "#php_flag register_globals Off" in the root MODX Rev .htaccess file. While this does not throw a 500 error I still get the "Configuration Error" in the Manager.

I then tried disabling the above .htaccess file and instead tried this MacHighway tutorial regarding register_globals and the php.ini file http://tinyurl.com/6muvgu7 but this does throw a 500 error.

I'm stumped. MacHighway support can't help so I'm asking here. This really shouldn't be that difficult, should it?

Thanks

hi,

well, the thing is, depending on you hoster config, the htaccess "command" varies from sentEnv var to the flag line with different syntax... they should be able, at least, to tell you which one

something else, depending on your hoster config too, you may have to modify a local php.ini file instead of doing this with htaccess, this can take place either in the website directory or, for example in a php5 directory one step above you site root

have swing

forgot to say something, personally i would not stay with a hoster whose config has register globals set to on, it's a wide open door to hackers and you may experiment server down issues quite frequently

have swing

Update: Some minor progress

The web host was able to turn register_globals Off, I'm looking at the phpinfo file now. However, if I uncomment #php_flag register_globals Off in the root MODX htaccess file I still get the 500 error. Anyone have an idea or suggestion as to what the problem might be?

hi,

well, if your hoster turned it to off, no need to uncomment the htaccess line

the fact is, as i said, that depending on your hoster config, the server may not accept some htaccess commands or need to have them written with a different syntax (set entVar or else)

have swing

Quote from: virtualbear at Jun 13, 2012, 12:13 PM

hi,
well, if your hoster turned it to off, no need to uncomment the htaccess line

Ok, I commented the line again in the htaccess file and the 500 error is now gone. However, I'm still seeing the "Configuration Error" in the Manager. Now that r_g is Off I don't understand why MODX is still "seeing" r_g as being On. I even did a clean (re)install but still the same warning.

hi,

have a look at the phpinfo, there may be two values for the var, the master and the local one, the important one for you is the local as it concerns your space on the server
now, it's possible that modx reads the master value in its config file

if you want to ensure r_g are really off you can make a simple experiment, put a page, say test.php on you server with just in it
call it in you browser with just http://youdomain.com/test.php, normally, blank
now call http://youdomain.com/test.php?toto=test
if the page is still blank chances are they're off, if you see "test" in the page, run away

have swing

Quote from: virtualbear at Jun 14, 2012, 02:54 AM

have a look at the phpinfo, there may be two values for the var, the master and the local one, the important one for you is the local as it concerns your space on the server
now, it's possible that modx reads the master value in its config file

if you want to ensure r_g are really off you can make a simple experiment, put a page, say test.php on you server with just

<?php if ( isset($toto) ) echo $toto; ?>

in it
call it in you browser with just http://youdomain.com/test.php, normally, blank
now call http://youdomain.com/test.php?toto=test
if the page is still blank chances are they're off, if you see "test" in the page, run away

Thank you. This is interesting: I installed MODX two directories down from the root in my dev folder. Both r_g values in phpinfo (which is located in the site root, /public_html/) show r_g as Off. When I put your test file in the site root, /public_html/ it passes. However, when I placed a phpinfo file in the MODX folder (two levels below the root) and tried your test it failed. How can r_g be Off in /public_html/ but On in a sub-directory? Or am I misunderstanding things?

hi,

too bad, no, you understand things quite well and if my test files show test you're sure registers global are on and this is a huge security hole

in this case if i were you i would contact the hoster and ask them to turn them off or give you the ability to do this with a php.ini (as htaccess commands don't seem to be accepted) and, if they don't, sincerely, not a joke, change your hoster

the fact you can inject vars without retreiving them with $_POST, $_GET and so on is
- first, as i said a huge security hole, sort of a hackers welcome
- a real problem as you can't know for sure what var you're dealing with in you scripts, what makes things very hard to test even with for a simple form for example

have swing

Quote from: virtualbear at Jun 14, 2012, 01:27 PM

in this case if i were you i would contact the hoster and ask them to turn them off or give you the ability to do this with a php.ini (as htaccess commands don't seem to be accepted) and, if they don't, sincerely, not a joke, change your hoster

To be fair the web host is going the distance in trying to find the problem.

r_g is now turned Off in the modx folder (I'm looking at the phpinfo file) as well as /public_html/. However, I'm still getting a 500 error when I try to access the Manager, and no matter what I or the host have tried with regard to the .htaccess or php.ini file in the modx folder it still doesn't work.