[Xitami] Newbie question: Xitami and php

[Russel Olinger]

I just got the same error, however, if we add that line to the php.ini file
won't we be opening ourselves up to security risks?  And in fact, I added
that line already but I am still getting the security error.


----- Original Message -----
From: "Marcio Marchini" <mqm@magma.ca>
To: <xitami@lists.xitami.org>
Sent: Thursday, March 28, 2002 10:56 AM
Subject: RE: [Xitami] Newbie question: Xitami and php


>
> go to php.ini (c:\winnt\php.ini) and add this:
>
> force-cgi-redirect=0
>
>
> This is from memory, I would have to double-check on my Xitami/PHP
machine,
> which I can't do right now.
>
>
> marcio
>
> > -----Original Message-----
> > From: xitami-admin@lists.xitami.org
> > [mailto:xitami-admin@lists.xitami.org]On Behalf Of Ed op Het Net
> > Sent: March 28, 2002 1:34 PM
> > To: xitami@lists.xitami.org
> > Subject: [Xitami] Newbie question: Xitami and php
> >
> >
> > I have Xitami up and running on Windows 98 SE.
> > I've installed the latest distribution of php4.
> > Now, whenever I open a php-file (like phpinfo.php)
> > in my browser on the localhost-adress I receive the following message:
> >
> > "Security Alert! PHP CGI cannot be accessed directly.
> > This PHP CGI binary was compiled with force-cgi-redirect enabled.
> > This means that a page will only be served up if the REDIRECT_STATUS
> > CGI variable
> > is set. This variable is set, for example, by Apache's Action
> > directive redirect.
> > You may disable this restriction by recompiling the PHP binary with
> > the --disable-force-cgi-redirect switch. If you do this and you have
your
> > PHP CGI binary accessible somewhere in your web tree, people will be
able to
> > circumvent .htaccess security by loading files through the PHP parser.
> > A good way around this is to define doc_root in your php.ini file to
> > something other
> > than your top-level DOCUMENT_ROOT. This way you can separate the part
> > of your web space
> > which uses PHP from the normal part using .htaccess security. If you
> > do not have
> > any .htaccess restrictions anywhere on your site you can leave
> > doc_root undefined.
> > If you are running IIS, you may safely set cgi.force_redirect=0 in
> > php.ini."
> >
> > I tried everything, but I can't get it to work, and an internet- and
> > faq-search didn't make me any wiser.
> > Can someone explain me in plain and simple English which steps I have
> > to take to solve this?
> >
> > Thanks in advance, Edward
> >
> >
> > --
> > Xitami Users Mailing List -- For Xitami support
> > To unsubscribe: http://lists.xitami.org/mailman/listinfo/xitami
> >
>
>
> --
> Xitami Users Mailing List -- For Xitami support
> To unsubscribe: http://lists.xitami.org/mailman/listinfo/xitami
>
>