Virutal server now has beefed up PHP security

By dkaufman1 on 10 Jul 2003 at 20:40 UTC

I am installing for the first time and have searched the forums and documentation but couldn't find a discussion for a newbie about how to handle .htaccess if your PHP is now run as CGI not as a module for "added security".

This is important because I amd getting the message about:

Note that the value of PHP's configuration option magic_quotes_gpc is incorrect. It should be set to '0' for Drupal to work properly. Either configure your webserver to support .htaccess files so Drupal's .htaccess file can set it to the proper value, or edit your php.ini file directly. This message will automatically dissapear when the problem has been fixed.

I have attemtped to figure out how to create my own PHP.ini file and write the correct information to this file (because the .htaccess file will not allow PHP directives). I thought this might be a text file but I wasn't exactly sure what to add to it.

Any help would be appreciated.

Drupal ver. 4.1
Apache Web Server
MySQL

Comments

this might help

cel4145 commented 11 July 2003 at 06:19

I've never done this myself, but Dezina hosting has some information on setting up php.ini files for their php CGI enabled virtual hosts.

Thanks...but still not right

dkaufman1 commented 11 July 2003 at 22:18

Ok...I attemtped to follow the instructions listed at the Dezina site as that the "module" talk is the problem I am encountering.

I created a text file called php.ini I cut the following from the .htaccess file

php_value register_globals 1
php_value track_vars 1
php_value short_open_tag 1
php_value magic_quotes_gpc 0
php_value magic_quotes_runtime 0
php_value magic_quotes_sybase 0
php_value session.cache_expire 200000
php_value session.cookie_lifetime 2000000
php_value session.auto_start 0
php_value session.save_handler user
php_value session.cache_limiter none
php_value allow_call_time_pass_reference Off

That is in it's own file.

Still in the .htaccess file is:

#
# Apache/PHP/site settings:
#

# Protect files and directories from prying eyes:

order deny,allow
deny from all

# Deny directory listings:
Options -Indexes

# Customized server error messages:
ErrorDocument 400 /error.php
ErrorDocument 402 /error.php
ErrorDocument 403 /error.php
ErrorDocument 404 /error.php
ErrorDocument 500 /error.php

# Various rewrite rules

RewriteEngine on
RewriteRule ^blog/(.*) /module.php?mod=blog\&name=$1 [R]

# $Id: .htaccess,v 1.38.2.2 2002/12/08 08:19:56 dries Exp $

But now all the commands in the php.ini are not being recognized, ad I now have the following on my site:

Note that the value of PHP's configuration option register_globals is incorrect. It should be set to '1' for Drupal to work properly. Either configure your webserver to support .htaccess files so Drupal's .htaccess file can set it to the proper value, or edit your php.ini file directly. This message will automatically dissapear when the problem has been fixed.

Please help, it is appreciated.

PHP config in php.ini vs. .htaccess

cczona commented 12 July 2003 at 00:34

The PHP online manual has more detailed info on php.ini, but essentially: copy/pasting between php.ini and .htaccess isn't working because Apache and PHP have different config syntax. Ex.:

<p>php_value register_globals        1

<p><i>vs.</i>

<p>register_globals=true

We are getting somewhere...

dkaufman1 commented 13 July 2003 at 16:00

cczona - the advice I got from you via the php online manual was great. I have corrected the magic quotes and understand that the syntax is a little different.

I am still getting one error from earlier:

Here is my current php.ini file (note the register_globals is set to 1, also note that the cache and cookie information appears to not be in the right format, but I didn't know how to fix it exactly):

php_value register_globals = 1
php_value track_vars = on
php_value short_open_tag = on
magic_quotes_gpc = off
php_value magic_quotes_runtime = off
php_value magic_quotes_sybase = off
php_value session.cache_expire 200000
php_value session.cookie_lifetime 2000000
php_value session.auto_start = off
php_value session.save_handler user
php_value session.cache_limiter none
php_value allow_call_time_pass_reference = off

Here is my .htaccess file (nothing has changed from a few posts back), I am not sure that my Virtual server even uses the this file. But I am posting it just in case:

#
# Apache/PHP/site settings:
#

# Protect files and directories from prying eyes:

order deny,allow
deny from all

# Deny directory listings:
Options -Indexes

# Customized server error messages:
ErrorDocument 400 /error.php
ErrorDocument 402 /error.php
ErrorDocument 403 /error.php
ErrorDocument 404 /error.php
ErrorDocument 500 /error.php

# Various rewrite rules

RewriteEngine on
RewriteRule ^blog/(.*) /module.php?mod=blog\&name=$1 [R]

# $Id: .htaccess,v 1.38.2.2 2002/12/08 08:19:56 dries Exp $

Thanks again.

Try "register_globals=on" instead of "register_globals=1"

cczona commented 13 July 2003 at 19:53

I can't seem to local a page explicitely stating which values are acceptable as booleans in php.ini syntax. Some settings do seem to accept 0/1 as booleans, but the documentation examples imply that on/off are the preferred values. See if using "register_globals=on" (don't forget to restart Apache after the change!) resolves the error.

And if that does fix it, be sure to open a bug report about that error message.)

(ashamed)...

dkaufman1 commented 14 July 2003 at 03:39

I made the change but don't know how to restart my apache (virtual) server. It doesn't work at this moment before restarting.

If php is run as cgi, I don't

torgeirb commented 14 July 2003 at 08:46

If php is run as cgi, I don't think restart is neccessary.
If what you pasted earlier was from php.ini, 'php_value' is an Apache directive. In php.ini it should only say 'register_globals = on'.

torgeirb rocks!

dkaufman1 commented 14 July 2003 at 16:57

Thanks that did the trick. I have emailed my portable device the Drupal Documentation, and will now begin learning about all the modules and playing around. Thanks again! I am happy to report that if you have a hosting provider who no longer allows .htaccess files and uses php as described above. Create a php.ini file that looks like this:

register_globals = on
track_vars = on
short_open_tag = on
magic_quotes_gpc = off
magic_quotes_runtime = off
magic_quotes_sybase = off
session.cache_expire 200000
session.cookie_lifetime 2000000
session.auto_start = off
session.save_handler user
session.cache_limiter none
allow_call_time_pass_reference = off

That should do the trick.

Anyone want to give a breakdown of what everything means in this file in laymen's terms? What are magic quotes anyway? Is that code to allow double and single quotes that are not straight but turn in? I figure that PHP must use a lot of quotes to set off things in the coding and this helps seperate people's posts with "this is awesome" quoted from screwing it up.

Again thanks for the initial problem solving. Drupal's community is just as important, if not more so, in making this overall solution a success (so far) in my view.

Damn!

dkaufman1 commented 15 July 2003 at 15:30

Well it was working for what about 12 hours. I go into the site today to begin learning about the tools Drupal offers, and I see the old error back:

I went into the php.ini file and changed the magic_quotes_gpc from "= off" to "= 0". But the error still persists.

Any help is again appreciated.

Ok - I did re-read my chain o

dkaufman1 commented 15 July 2003 at 15:32

Ok - I did re-read my chain of posts/problems and realized that I have now had the error be both "set to 0" and "set to 1". That seems very weird. What did I do now?

Any ideas?

dkaufman1 commented 16 July 2003 at 15:44

I am really stuck as to what to do with the magic_quotes, Drupal has listed both "set to 0" and "set to 1" errors. I have played around with php.ini file to try and fix this problem and it will not correct itself. Currently the error says set to 0, which my php.ini file is set to.

What can I do to fix this most annoying error?

Caching issue?

dries commented 16 July 2003 at 21:35

If you are viewing your Drupal site as an anonymous user, make sure to disable the cache. Does the error show up when you are authenticated?

It works! Thanks :D

matheney commented 21 November 2003 at 05:31

It works!

Thanks :D