'register_globals is set to ON in your php.ini configuration file'

Hi
I got one message as follows in my modxmanager page;
"
One or more configuration details didn’t check out OK:

Configuration warning: ’register_globals is set to ON in your php.ini configuration file’

What does this mean?
This configuration makes your site much more susceptible to Cross Site Scripting (XSS) attacks. You should speak to your host about what you can do to disable this setting.
"
How can I solve this ? where can I change this php.ini file ?

Thanks in advance

Jurdy

Just uncomment (delete #) line #php_flag register_globals Off in .htaccess on the root of your site

But still the warning is appearing. There is any problem for site with this warning ?

I did it like following way;
1. There is one .htaccess file is there in our site root.
2. So a new copy of ht.access file opened and uncomment the line as you mentioned and saved.
3. Upload the file to the site root and renamed it to .htaccess
But when logged into the manager, the same warning is showing
Tried with clearcache and login again. but still the warning is there.

Thanks & Regards
jurdy

Take a look at your Manager->Reports->System Info, the phpinfo View link. In the Configuration PHP Core block you’ll see the settings for register-globals. One column is for the local value and should reflect the action of the .htaccess file, the other is the global setting taken from the php.ini file.

If there is an existing .htaccess file in your site root, try to rename your ht.access file to .htaccess and then upload it after you uncomment the mentioned line, this way you make sure that the file is overwritten correctly, sometimes it simply don’t overwrite if you rename ht.access after the upload and servers mostly rely on the pioneer .htaccess file.

Also check this:

Manager->Reports->System Info phpinfo() Apache API and see if it says APACE or CGI if it says CGI you will have to check with your host to see if your server is running suExec. Suffice it to say that you cannot override php.ini with .htaccess under this server type and you will likely have to add a php.ini file to every main folder in MODx that includes the following line:



If your server is running suExec you cannot override any php settings with .htaccess including turning on compression.

I am currently working on a patch for the installer that will check the server config on the installer that will help with this so there is no mystery when the site is installed.

Cheers,

jay

Quote from: smashingred at Jan 16, 2008, 08:55 PM

I am currently working on a patch for the installer that will check the server config on the installer that will help with this so there is no mystery when the site is installed.

Good news, looking forward to see it, this will solve many users headache about configuring .htaccess file specially when it is their first ride on the servers.

Yeah,

I have answered this question several times and I think it is all too common now for many shared server hosts to use suExec and PHP as a CGI Binary (for Security). While I won’t debate the merits it is fairly easy to get the server API and to check the status of register globals before so adding it to the config check page in the installer is a fairly short piece of code.

One could go so far as to append the existing .htaccess file with the register globals off directive if APache or create and populate all the php.ini files if running as suExec (a little harder to check for accurately but doable).

Hopefully I can get the patch done for for the next release.



Cheers,
Jay

All the best brother, let me know in case you wanted to test in various environments :-]

I have submitted an interim patch to do the check in the installer. I am about halfway through coding out the logic for a register_globals fix that can check the Server API, check the existence of either php.ini or .htaccess and either append or create a file to address the register_globals issue. I don’t think that it should be done automatically though as I have figured it may be problematic for those on dedicated servers or in unique shared environments. That being said I will be making an undo command to enable people to recover from an error caused by this.

Cheers,

Jay

I will start a new thread in the core code forum when I have finished to get testers.

Cheers,

Jay