affix ownz u

Authored by: Dirk on Sunday, June 08 2003 @ 02:45 PM EDT

You have register_globals=off (that's the default in PHP since 4.2.0).

bye, Dirk

[ Reply to This | # ]

Authored by: amckay on Sunday, June 08 2003 @ 02:50 PM EDT

My php.ini has this in it as always. But I will check to ensure that the new php I installed is reading it from the same place. I always keep it in /etc/php.ini, and just now created a link to /usr/local/etc/php.ini and restarted apache, and that did not fix the problem.

max_execution_time=300
register_globals=on
upload_tmp_dir=/tmp
session.save_path=/tmp

I'll keep you posted ...

[ Reply to This | # ]

Authored by: amckay on Sunday, June 08 2003 @ 03:25 PM EDT

Well, I found out that it goes in /usr/local/lib/php.ini, but that still did not work. So I took the php.ini-recommended from the distribution and turned register_globals on, and also set upload_tmp_dir=/tmp as per my usual file. Not sure what else in that default file is required to make this work, but it does seem as though it is more than just register_globals.

Of course, will turning register_globals on mean that my site is vulnerable to this cracker again? Any idea?

[ Reply to This | # ]

Authored by: Dirk on Sunday, June 08 2003 @ 03:45 PM EDT

Make sure you're editing the correct copy of php.ini - if in doubt, upload a file with only <?php phpinfo() ?> in it and check where it expects to find the php.ini. Also, don't forget to restart your webserver when you're making any changes.

You didn't mention any version numbers (neither the old nor the new version of PHP you're running), but I can assure you that Geeklog is running just fine with the current PHP 4.3.2 release (when you set register_globals=on, of course).

The register_globals settings has nothing to do with vulnerabilities. There was a upload vulnerability in some really old versions of PHP (before 4.1.2, IIRC). Apart from the issues that have been fixed with Geeklog 1.3.7sr2, there are also reports of vulnerabilities in some versions of Gallery (if you're using that), so make sure you really update all the components of your site ...

bye, Dirk

[ Reply to This | # ]

Authored by: Anonymous on Sunday, June 08 2003 @ 04:11 PM EDT

Thanks Dirk. I always keep http://www.alanmckay.com/phpinfo.php so I can check my version any time I like, but I totally forgot that it tells me where it expects to find php.ini! I saved a copy of the output before my upgrade, and I see it was 4.3.0 and GL worked just fine with the short php.ini file I posted. Now I'm running 4.3.2 with noted problems.

But all is fine now as mentioned, once I used the php.ini-recommend and turned globals on. As for Gallery, I do run it on a few sites, but some of the ones that got hit were not running it. I recently tried the Geekary and like it better anyway, so now I have to begin a very painful migration ;-)

[ Reply to This | # ]