[Xitami] Security Alert! PHP CGI cannot be accessed directly.

Bob Paddock xitami@lists.xitami.org
Thu, 24 Jan 2002 07:26:25 -0500


I'm running Xitami on my Linux box, I wanted to try out some PHP scripts and 
I got the following, can some one transliate what it might mean for Xitami 
since it seems to be written fro Apache?:

"Security Alert! PHP CGI cannot be accessed directly.
This PHP CGI binary was compiled with force-cgi-redirect enabled.  This
means that a page will only be served up if the REDIRECT_STATUS CGI variable 
is set.  This variable is set, for example, by Apache's Action directive 
redirect.

You may disable this restriction by recompiling the PHP binary with the
--disable-force-cgi-redirect switch.  If you do this and you have your PHP CGI
binary accessible somewhere in your web tree, people will be able to 
circumvent .htaccess security by loading files through the PHP parser.  A 
good way around this is to define doc_root in your php.ini file to something 
other than your top-level DOCUMENT_ROOT.  This way you can separate the part 
of your web space which uses PHP from the normal part using .htaccess 
security.  If you do not have any .htaccess restrictions anywhere on your 
site you can leave doc_root undefined."