[Xitami] Newbie question: Xitami and php

[Russel Olinger]

Ed:

I got this to work but there are a few catches:
1.  cgi.force_redirected = 0   ;;; make certain the ";" is removed from the
front of the line..
2.  All php files must go into the *./webpages directories for each of your
domains
3.  Pros/Cons of using the "doc_root" variable:
    CONS:
        1. #2 won't apply if you define it - ALL php files for all domains
must go into that directory, thus your files start to get jumbled together
and files for virtual domain "blah.com" will sit in the same directory for
another virtual domain "blah1.com".  There could possibly be a way around
this if you did something along the following (I haven't tested it though):
            PHP.INI: doc_root = /xitami/php
            Xitami blah1.cfg: [Alias Section] *.php = /xitami/php/blah1/
            Xitami blah2.cfg: [Alias Section] *.php = /xitami/php/blah2/

            You would have to manually created each virtual domain directory
reference in the /xitami/php directory - you would then also have to force
FTP paths so those domain admins could upload php files for their domain,
ONLY to their directory.  I think this might work.  You definently have to
jump through hoops though.

        2. By not defining the doc_root variable you could possibly open
your server to security risks.  The doc_root variable is designed to work
similar to the /cgi-bin URL call in xitami...forcing all CGIs to be in a
certain place outside of the webpages path.

    PROS:
        1. This is a security feature in PHP that allows you to remove the
php files from your accessable webpage tree path.  By default, an undefined
"doc_root" will allow the following paths to work:: /xitami/webpages/*.php,
or /xitami/webpages/php/*.php, OR  /xitami/domain1/webpages/*.php or
/xitami/domain2/webpages/scripts/*.php

A defined "doc_root" variable forces everything to that specific directory
but will prevent users from using PHP properties to scan your entire server,
outside of Xitami.

Hope this helps.
Russel


----- Original Message -----
From: "Ed op Het Net" <ed.ed@hetnet.nl>
To: "xitami-request@lists.xitami.org" <xitami@lists.xitami.org>
Sent: Friday, March 29, 2002 8:55 AM
Subject: RE: [Xitami] Newbie question: Xitami and php


>
> xrlxo> Marcio Marchini wrote:
>
> xrlxo> go to php.ini (c:\winnt\php.ini) and add this:
> xrlxo> force-cgi-redirect=0
>
>
> Hi Marcio, this still doesn't work.
> After changing the cgi.force to zero, I still receive the same error.
> Next, I've changed the doc_root, but then I get a blank page.
> That is of course one step further :)
>
> I use phpinfo.php, containing the script:
>     <?php phpinfo();?>
>
> The output is a blank html-page.
>
> >From the command line everything works fine, so it must be a matter of
> configurating the php.ini or Xitami.
>
> Do you think you can help me further?
>
> TIA, Edward
>
>
>
>
>
>
> >> -----Original Message-----
> >> [mailto:xitami-admin@lists.xitami.org]On Behalf Of Ed op Het Net
> >> Subject: [Xitami] Newbie question: Xitami and php
> >>
> >>
> >> I have Xitami up and running on Windows 98 SE.
> >> I've installed the latest distribution of php4.
> >> Now, whenever I open a php-file (like phpinfo.php)
> >> in my browser on the localhost-adress I receive the following message:
> >>
> >> "Security Alert! PHP CGI cannot be accessed directly.
> >> This PHP CGI binary was compiled with force-cgi-redirect enabled.
> >> This means that a page will only be served up if the REDIRECT_STATUS
> >> CGI variable
> >> is set. This variable is set, for example, by Apache's Action
> >> directive redirect.
> >> You may disable this restriction by recompiling the PHP binary with
> >> the --disable-force-cgi-redirect switch. If you do this and you have
your
> >> PHP CGI binary accessible somewhere in your web tree, people will be
able to
> >> circumvent .htaccess security by loading files through the PHP parser.
> >> A good way around this is to define doc_root in your php.ini file to
> >> something other
> >> than your top-level DOCUMENT_ROOT. This way you can separate the part
> >> of your web space
> >> which uses PHP from the normal part using .htaccess security. If you
> >> do not have
> >> any .htaccess restrictions anywhere on your site you can leave
> >> doc_root undefined.
> >> If you are running IIS, you may safely set cgi.force_redirect=0 in
> >> php.ini."
> >>
> >> I tried everything, but I can't get it to work, and an internet- and
> >> faq-search didn't make me any wiser.
> >> Can someone explain me in plain and simple English which steps I have
> >> to take to solve this?
> >>
> >> Thanks in advance, Edward
> >>
>
>
> --
> Xitami Users Mailing List -- For Xitami support
> To unsubscribe: http://lists.xitami.org/mailman/listinfo/xitami
>
>