By samglover on

I just upgraded to 6.1, and now I am seeing a couple of error messages. 

Access to update.php	Not protected
The update.php script is accessible to everyone without authentication check, which is a security risk. You must change the $update_free_access value in your settings.php back to FALSE.

and

PHP register globals	Enabled ('1')
register_globals is enabled. Drupal requires this configuration directive to be disabled. Your site may not be secure when register_globals is enabled. The PHP manual has instructions for how to change configuration settings.

What? The PHP manual link is completely incomprehensible and unhelpful. How do I fix these problems?

⋅ Categories: Drupal 6.x

Comments

Anonymous’s picture

Anonymous (not verified) commented

Well...

The first warning message gives you the answer in the warning:

ftp into your site and open up your sites/default/settings.php file.

Around about line 105 you should see:

$update_free_access = TRUE;

change that to:

$update_free_access = FALSE;

With regard to PHP register globals, there are three options:

1. The first thing to do would be to contact your host and get them to disable it (having it enabled by default is not recommended).

2. Amend your .htaccess file by adding the following to the end of the section for the PHP + Apache combination you are using.:

php_value register_globals 0

It won't do any harm to add it to all three sections if you are unsure which is correct.

It would look like this:

# PHP 4, Apache 1.
<IfModule mod_php4.c>
  php_value magic_quotes_gpc                0
  php_value register_globals                0
  php_value session.auto_start              0
  php_value mbstring.http_input             pass
  php_value mbstring.http_output            pass
  php_value mbstring.encoding_translation   0
  php_value register_globals 0
</IfModule>

# PHP 4, Apache 2.
<IfModule sapi_apache2.c>
  php_value magic_quotes_gpc                0
  php_value register_globals                0
  php_value session.auto_start              0
  php_value mbstring.http_input             pass
  php_value mbstring.http_output            pass
  php_value mbstring.encoding_translation   0
  php_value register_globals 0
</IfModule>

# PHP 5, Apache 1 and 2.
<IfModule mod_php5.c>
  php_value magic_quotes_gpc                0
  php_value register_globals                0
  php_value session.auto_start              0
  php_value mbstring.http_input             pass
  php_value mbstring.http_output            pass
  php_value mbstring.encoding_translation   0
  php_value register_globals 0
</IfModule>

3. Create a file called php.ini and add it to your site root. It just needs to contain one line:

register_globals = off

It depends on your web host as to whether this will be allowed.

And if none of those work, find a new host :)

Barry

defigart’s picture

defigart commented

I keep getting this when I try to change "TRUE" to "FALSE"

[a fatal error or timeout occurred while processing this directive]