Skip to Content.
Sympa Menu

ibiblio-announce - [ibiblio-announce] PHP config change: disabling URL inclusion

ibiblio-announce AT lists.ibiblio.org

Subject: ibiblio services/changes announcement list

List archive

Chronological Thread  
  • From: Don Sizemore <dls AT ibiblio.org>
  • To: ibiblio-announce AT lists.ibiblio.org
  • Subject: [ibiblio-announce] PHP config change: disabling URL inclusion
  • Date: Thu, 4 Jun 2009 10:21:42 -0400 (EDT)


Hello all,

I apologize for the short (really, lack of) notice, but I've made two small changes to ibiblio's global PHP configuration:

allow_url_fopen OFF
allow_url_include OFF

These two options were introduced into PHP-5.2 in order to be set to off to tighten security. Frankly we should have done it before now, but during the last PHP upgrade we felt we had to leave them on for compatibility with some of our older hosted sites. Leaving these settings on exposes us to URL injection vulnerabilities. If you absolutely require allow_url_fopen or allow_url_include to be turned on, do let us know via http://www.ibiblio.org/help/

Again, I apologize for the short notice, but we simply can't leave these options enabled any longer.

thank you, 919.962.5646 w
donald sizemore, ii 919.260.4915 c
ibiblio.org systems 919.962.8071 f



  • [ibiblio-announce] PHP config change: disabling URL inclusion, Don Sizemore, 06/04/2009

Archive powered by MHonArc 2.6.24.

Top of Page