ibiblio-announce AT lists.ibiblio.org
Subject: ibiblio services/changes announcement list
List archive
[ibiblio-announce] PHP config change: disabling URL inclusion
- From: Don Sizemore <dls AT ibiblio.org>
- To: ibiblio-announce AT lists.ibiblio.org
- Subject: [ibiblio-announce] PHP config change: disabling URL inclusion
- Date: Thu, 4 Jun 2009 10:21:42 -0400 (EDT)
Hello all,
I apologize for the short (really, lack of) notice, but I've made two small changes to ibiblio's global PHP configuration:
allow_url_fopen OFF
allow_url_include OFF
These two options were introduced into PHP-5.2 in order to be set to off to tighten security. Frankly we should have done it before now, but during the last PHP upgrade we felt we had to leave them on for compatibility with some of our older hosted sites. Leaving these settings on exposes us to URL injection vulnerabilities. If you absolutely require allow_url_fopen or allow_url_include to be turned on, do let us know via http://www.ibiblio.org/help/
Again, I apologize for the short notice, but we simply can't leave these options enabled any longer.
thank you, 919.962.5646 w
donald sizemore, ii 919.260.4915 c
ibiblio.org systems 919.962.8071 f
- [ibiblio-announce] PHP config change: disabling URL inclusion, Don Sizemore, 06/04/2009
Archive powered by MHonArc 2.6.24.