[ibiblio-announce] PHP config change: disabling URL inclusion
Don Sizemore
dls at ibiblio.org
Thu Jun 4 10:21:42 EDT 2009
Hello all,
I apologize for the short (really, lack of) notice, but I've made two
small changes to ibiblio's global PHP configuration:
allow_url_fopen OFF
allow_url_include OFF
These two options were introduced into PHP-5.2 in order to be set to off
to tighten security. Frankly we should have done it before now, but
during the last PHP upgrade we felt we had to leave them on for
compatibility with some of our older hosted sites. Leaving these settings
on exposes us to URL injection vulnerabilities. If you absolutely require
allow_url_fopen or allow_url_include to be turned on, do let us know via
http://www.ibiblio.org/help/
Again, I apologize for the short notice, but we simply can't leave these
options enabled any longer.
thank you, 919.962.5646 w
donald sizemore, ii 919.260.4915 c
ibiblio.org systems 919.962.8071 f
More information about the ibiblio-announce
mailing list