We launched new forums in March 2019—join us there. In a hurry for help with your website? Get Help Now!
    • 26997
    • 13 Posts
    hello
    this is my first subject , when i install modx cms i need to make register Global in OFF because its now ON
    but i dont know when can i found this file to edit it php.ini

    Thanks
      • 27708 MODX Staff
      • 2,502 Posts
      First: Try to turn of register globals using the .htaccess which is named ht.access in the root directory of MODx. If you are able to get regsiter globals off with this change then you don’t need a php.ini file.

      php.ini files can be added but are typically only required on servers where php runs in cgi or on suExec built servers.

      If you need to use php.ini you would have to create one in each of the folders that you wish to turn register globals off in (/root, /manager, /manager/includes, possibly others) and you should add the following:

      register_globals = Off
        Author of zero books. Formerly of many strange things. Pairs well with meats. Conversations are magical experiences. He's dangerous around code but a markup magician. Blog ✦ Twitter ✦ LinkedIn ✦ GitHub
        • 26997
        • 13 Posts
        thanks for your help
        i dont know how can i modfiy the ht.acess file so i give you this file :

        # MODx supports Friendly URLs via this .htaccess file. You must serve web
        # pages via Apache with mod_rewrite to use this functionality, and you must
        # change the file name from ht.access to .htaccess.
        #
        # Make sure RewriteBase points to the directory where you installed MODx.
        # E.g., "/modx" if your installation is in a "modx" subdirectory. If you have
        # problems with your .htaccess working at all, try un-commenting the first 
        # line above the "RewriteEngine On" directive.
        #
        # You may choose to make your URLs non-case-sensitive by adding a NC directive
        # to your rule: RewriteRule ^(.*)$ index.php?q=$1 [L,QSA,NC]
        
        #Options +FollowSymlinks
        RewriteEngine On
        RewriteBase /
        
        
        
        # Rewrite www.domain.com -> domain.com -- used with SEO Strict URLs plugin
        #RewriteCond %{HTTP_HOST} .
        #RewriteCond %{HTTP_HOST} !^example-domain-please-change\.com [NC]
        #RewriteRule (.*) http://example-domain-please-change.com/$1 [R=301,L]
        #
        # or for the opposite domain.com -> www.domain.com use the following
        # >>> DO NOT USE BOTH THE ABOVE AND BELOW <<<
        #
        #RewriteCond %{HTTP_HOST} .
        #RewriteCond %{HTTP_HOST} !^www\.example-domain-please-change\.com [NC]
        #RewriteRule (.*) http://www.example-domain-please-change.com/$1 [R=301,L]
        
        
        
        # Rewrite secure requests properly to prevent SSL cert warnings, e.g. prevent 
        # https://www.domain.com when your cert only allows https://secure.domain.com
        #RewriteCond %{SERVER_PORT} !^443
        #RewriteRule (.*) https://example-domain-please-change.com.com/$1 [R=301,L]
        
        
        
        # The Friendly URLs part
        RewriteCond %{REQUEST_FILENAME} !-f
        RewriteCond %{REQUEST_FILENAME} !-d
        RewriteRule ^(.*)$ index.php?q=$1 [L,QSA]
        
        
        
        # Make sure .htc files are served with the proper MIME type, which is critical # for XP SP2. Un-comment if your host allows htaccess MIME type overrides.
        
        #AddType text/x-component .htc
        
        
        
        # If your server is not already configured as such, the following directive
        # should be uncommented in order to set PHP's register_globals option to OFF.
        # This closes a major security hole that is abused by most XSS (cross-site
        # scripting) attacks. For more information: http://php.net/register_globals
        #
        # To verify that this option has been set to OFF, open the Manager and choose
        # Reports -> System Info and then click the phpinfo() link. Do a Find on Page
        # for "register_globals". The Local Value should be OFF. If the Master Value
        # is OFF then you do not need this directive here.
        #
        # IF REGISTER_GLOBALS DIRECTIVE CAUSES 500 INTERNAL SERVER ERRORS :
        #
        # Your server does not allow PHP directives to be set via .htaccess. In that
        # case you must make this change in your php.ini file instead. If you are
        # using a commercial web host, contact the administrators for assistance in
        # doing this. Not all servers allow local php.ini files, and they should
        # include all PHP configurations (not just this one), or you will effectively
        # reset everything to PHP defaults. Consult www.php.net for more detailed
        # information about setting PHP directives.
        
        #php_flag register_globals Off
        
        
        
        # For servers that support output compression, you should pick up a bit of
        # speed but un-commenting the following lines.
        
        #php_flag zlib.output_compression On
        #php_value zlib.output_compression_level 5
        
        
        
        # The following directives stop screen flicker in IE on CSS rollovers. If
        # needed, un-comment the following rules. When they're in place, you may have
        # to do a force-refresh in order to see changes in your designs.
        
        #ExpiresActive On
        #ExpiresByType image/gif A2592000
        #ExpiresByType image/jpeg A2592000
        #ExpiresByType image/png A2592000
        #BrowserMatch "MSIE" brokenvary=1
        #BrowserMatch "Mozilla/4.[0-9]{2}" brokenvary=1
        #BrowserMatch "Opera" !brokenvary
        #SetEnvIf brokenvary 1 force-no-vary



        thanks
          • 27708 MODX Staff
          • 2,502 Posts
          Quote from: shendo00 at Aug 31, 2007, 11:16 AM

          thanks for your help
          i dont know how can i modfiy the ht.acess file so i give you this file

          First just rename it to .htaccess. It is shipped as ht.access so it won’t automatically affect the server without your wish.

          Second remove the # in front of php_flag register_globals Off as is below.

          If you try to load your website and you get a Internal Server Error 500 put the # back in front of php_flag register_globals Off
          and see what happens. If you get your MODx index good. If you get a blank page it is likely that your RewriteBase needs to be changed from root to some other path.

          If you did get the Internal Server Error 500 then you should create the php.ini in the directories as I previously mentioned.

          All the best,
          Jay

          Let us know how far you have gotten and if you have new problems please post a new question. If it is still related to the register globals





          # MODx supports Friendly URLs via this .htaccess file. You must serve web
          # pages via Apache with mod_rewrite to use this functionality, and you must
          # change the file name from ht.access to .htaccess.
          #
          # Make sure RewriteBase points to the directory where you installed MODx.
          # E.g., "/modx" if your installation is in a "modx" subdirectory. If you have
          # problems with your .htaccess working at all, try un-commenting the first 
          # line above the "RewriteEngine On" directive.
          #
          # You may choose to make your URLs non-case-sensitive by adding a NC directive
          # to your rule: RewriteRule ^(.*)$ index.php?q=$1 [L,QSA,NC]
          
          #Options +FollowSymlinks
          RewriteEngine On
          RewriteBase /
          
          
          
          # Rewrite www.domain.com -> domain.com -- used with SEO Strict URLs plugin
          #RewriteCond %{HTTP_HOST} .
          #RewriteCond %{HTTP_HOST} !^example-domain-please-change\.com [NC]
          #RewriteRule (.*) http://example-domain-please-change.com/$1 [R=301,L]
          #
          # or for the opposite domain.com -> www.domain.com use the following
          # >>> DO NOT USE BOTH THE ABOVE AND BELOW <<<
          #
          #RewriteCond %{HTTP_HOST} .
          #RewriteCond %{HTTP_HOST} !^www\.example-domain-please-change\.com [NC]
          #RewriteRule (.*) http://www.example-domain-please-change.com/$1 [R=301,L]
          
          
          
          # Rewrite secure requests properly to prevent SSL cert warnings, e.g. prevent 
          # https://www.domain.com when your cert only allows https://secure.domain.com
          #RewriteCond %{SERVER_PORT} !^443
          #RewriteRule (.*) https://example-domain-please-change.com.com/$1 [R=301,L]
          
          
          
          # The Friendly URLs part
          RewriteCond %{REQUEST_FILENAME} !-f
          RewriteCond %{REQUEST_FILENAME} !-d
          RewriteRule ^(.*)$ index.php?q=$1 [L,QSA]
          
          
          
          # Make sure .htc files are served with the proper MIME type, which is critical # for XP SP2. Un-comment if your host allows htaccess MIME type overrides.
          
          #AddType text/x-component .htc
          
          
          
          # If your server is not already configured as such, the following directive
          # should be uncommented in order to set PHP's register_globals option to OFF.
          # This closes a major security hole that is abused by most XSS (cross-site
          # scripting) attacks. For more information: http://php.net/register_globals
          #
          # To verify that this option has been set to OFF, open the Manager and choose
          # Reports -> System Info and then click the phpinfo() link. Do a Find on Page
          # for "register_globals". The Local Value should be OFF. If the Master Value
          # is OFF then you do not need this directive here.
          #
          # IF REGISTER_GLOBALS DIRECTIVE CAUSES 500 INTERNAL SERVER ERRORS :
          #
          # Your server does not allow PHP directives to be set via .htaccess. In that
          # case you must make this change in your php.ini file instead. If you are
          # using a commercial web host, contact the administrators for assistance in
          # doing this. Not all servers allow local php.ini files, and they should
          # include all PHP configurations (not just this one), or you will effectively
          # reset everything to PHP defaults. Consult www.php.net for more detailed
          # information about setting PHP directives.
          
          
          php_flag register_globals Off
          
          
          
          # For servers that support output compression, you should pick up a bit of
          # speed but un-commenting the following lines.
          
          #php_flag zlib.output_compression On
          #php_value zlib.output_compression_level 5
          
          
          
          # The following directives stop screen flicker in IE on CSS rollovers. If
          # needed, un-comment the following rules. When they're in place, you may have
          # to do a force-refresh in order to see changes in your designs.
          
          #ExpiresActive On
          #ExpiresByType image/gif A2592000
          #ExpiresByType image/jpeg A2592000
          #ExpiresByType image/png A2592000
          #BrowserMatch "MSIE" brokenvary=1
          #BrowserMatch "Mozilla/4.[0-9]{2}" brokenvary=1
          #BrowserMatch "Opera" !brokenvary
          #SetEnvIf brokenvary 1 force-no-vary


            Author of zero books. Formerly of many strange things. Pairs well with meats. Conversations are magical experiences. He's dangerous around code but a markup magician. Blog ✦ Twitter ✦ LinkedIn ✦ GitHub
            • 26997
            • 13 Posts
            i have the same problem
            i dont know where is php.ini
            when i try o modifier ht.access as you say i have a big problem , now i cannot loggin to my Modx
            now i have delete the old Modx and uploading a new
            but the same problem is :

            One or more configuration details didn’t check out OK:
            Configuration warning: ’register_globals is set to ON in your php.ini configuration file’

            What does this mean?
            This configuration makes your site much more susceptible to Cross Site Scripting (XSS) attacks. You should speak to your host about what you can do to disable this setting
              • 27708 MODX Staff
              • 2,502 Posts
              As I said, you have to create a php.ini file on your server and place the code in it I said in my previous email.

              If you are not sure what you are doing and you don’t know how to rename your ht.access file to .htaccess you should say it clearly here and or hire someone to help you with this install. These are fairly simple parts of setting up websites, especially the .htaccess.
                Author of zero books. Formerly of many strange things. Pairs well with meats. Conversations are magical experiences. He's dangerous around code but a markup magician. Blog ✦ Twitter ✦ LinkedIn ✦ GitHub
                • 26997
                • 13 Posts
                ok
                what i have to do now is :

                to create a Php.ini and fill it with the Previous Code ?
                and rename the Ht.access to .htaccess ?

                ....????
                  • 27708 MODX Staff
                  • 2,502 Posts
                  First try renaming your ht.access to .htaccess if you get a 500 error, rename the file back to ht.access and then try creating a php.ini file in the /, /manager, /manager/includes, and with the code I mentioned above.

                    Author of zero books. Formerly of many strange things. Pairs well with meats. Conversations are magical experiences. He's dangerous around code but a markup magician. Blog ✦ Twitter ✦ LinkedIn ✦ GitHub
                    • 26997
                    • 13 Posts
                    thanks all are ok now !! cool
                      • 27708 MODX Staff
                      • 2,502 Posts
                      Glad to have been able to help you. If you have more questions don’t hesitate to ask.

                      All the best,

                      Jay
                        Author of zero books. Formerly of many strange things. Pairs well with meats. Conversations are magical experiences. He's dangerous around code but a markup magician. Blog ✦ Twitter ✦ LinkedIn ✦ GitHub