[ibiblio-announce] PHP config change: disabling URL inclusion

Don Sizemore dls at ibiblio.org
Thu Jun 4 10:21:42 EDT 2009


   Hello all,

   I apologize for the short (really, lack of) notice, but I've made two 
small changes to ibiblio's global PHP configuration:

allow_url_fopen   OFF
allow_url_include OFF

   These two options were introduced into PHP-5.2 in order to be set to off 
to tighten security.  Frankly we should have done it before now, but 
during the last PHP upgrade we felt we had to leave them on for 
compatibility with some of our older hosted sites.  Leaving these settings 
on exposes us to URL injection vulnerabilities.  If you absolutely require 
allow_url_fopen or allow_url_include to be turned on, do let us know via 
http://www.ibiblio.org/help/

   Again, I apologize for the short notice, but we simply can't leave these 
options enabled any longer.

   thank you,					919.962.5646 w
   donald sizemore, ii				919.260.4915 c
   ibiblio.org systems				919.962.8071 f


More information about the ibiblio-announce mailing list