We launched new forums in March 2019—join us there. In a hurry for help with your website? Get Help Now!
    • 6584
    • 37 Posts
    Just installed Evo 1.0.12, and when I try to put an image I get a popup window:

    The "safe_mode" PHP ini setting is turned on! You cannot run KCFinder in safe mode.

    I asked the hosting support to turn the safe mode off, but they say they cannot because of site safety.
    What can I do? Never had that kind of problem before.
      www.ri-mo.org
    • Your hosting provider is being ignorant. Safe mode has for years been known to be a bad idea, and as of PHP 5.3 it's been deprecated, and has been removed from PHP 5.4 altogether.

      The proper solution to the security issues that safe_mode attempted to solve is to use some form of suexec, suphp, or similar functionality so that scripts (perl, ruby, php, etc) are run as their owner rather than the web server user.

      http://php.net/manual/en/features.safe-mode.php
        Studying MODX in the desert - http://sottwell.com
        Tips and Tricks from the MODX Forums and Slack Channels - http://modxcookbook.com
        Join the Slack Community - http://modx.org
        • 6584
        • 37 Posts
        Thanx.

        Is there a way to turn it off from my side if the host provider refuses?
          www.ri-mo.org
          • 6584
          • 37 Posts
          Thanx.

          Is there a way to turn it off from my side if the host provider refuses?
            www.ri-mo.org
          • If you can't switch it off with php.ini or .htaccess is is time to change the provider. As Susan already said:

            Quote from: sottwell at Nov 24, 2013, 04:20 AM
            Your hosting provider is being ignorant. Safe mode has for years been known to be a bad idea, and as of PHP 5.3 it's been deprecated, and has been removed from PHP 5.4 altogether.
              • 6584
              • 37 Posts
              http://stackoverflow.com/questions/1982197/how-to-turn-off-php-safe-mode-off-for-a-particular-directory-in-a-shared-hosting?rq=1
              Thanks. That solves it for the moment, but displays a ton of warnings in CMS manager...

              Warning: strtotime() [function.strtotime]: It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'Europe/Berlin' for 'CET/1.0/no DST' instead in /home/aikienhr/public_html/manager/includes/rss.inc.php on line 50

              And database backup doesn't work any more.
                www.ri-mo.org
                  • 49622
                  • 4 Posts
                  Hi

                  I know this is a really old topic but I came across it today when I upgraded one of my old websites from Evolution version 1.0.4 to the latest Evolution version 1.0.15 (Yes I know this is a big version difference but the website worked fine for what it was meant to do).

                  What happened was after the upgrade everything worked except for the KCFinder as it was implying safe_mode was on.
                  While I thought I was sure the setting was not set to "on" in my php.ini I did go and did a double check. I found that the setting indeed was set to "off" how it should be.

                  So why was KCFinder still having issues?
                  After a search for "safe_mode" in the complete MODx source code I noticed a few IF statements that seem to be making the error.

                  The one that killed the KCFinder for example
                  if (ini_get("safe_mode"))
                      die("The \"safe_mode\" PHP ini setting is turned on! You cannot run KCFinder in safe mode.");
                  

                  This IF statement generated a TRUE because the ini_get() function returned a string and not a boolean.
                  var_dump(ini_get('safe_mode')); //returns: string(3) "off"
                  


                  I also found this in "assets\plugins\managermanager\widgets\ddresizeimage\phpthumb.class.php":
                  $this->issafemode = (bool) preg_match('#(1|ON)#i', ini_get('safe_mode'));
                  

                  This bit works correct as it checks if the value of ini_get('safe_mode') is either 1 or "on".

                  So I located all bits where the ini_get value was treated as a boolean by default and changed them.
                  For example the IF statement I mentioned above became:
                  if ((bool) preg_match('#(1|ON)#i', ini_get('safe_mode')))
                      die("The \"safe_mode\" PHP ini setting is turned on! You cannot run KCFinder in safe mode.");
                  



                  After uploading all the changed files to the server KCFinder worked perfectly again.
                  Even in an old topic like this I hope this helps someone.


                  Greets,

                  Bas
                  • Thanks! Could you do a PR on https://github.com/modxcms/evolution with that changed safe_mode checks, please?
                      • 49622
                      • 4 Posts
                      Sure, I'll see if I can get time somewhere this week, a bit swamped at the moment but I've got it noted on my TODO list.