Somebody could also try to run IIS with PHP 4.3.11dev snapshot to test if slasharguments work in ISAPI mode.
skodak
Slasharguments test in Health center
Number of replies: 6
I have just added a test for slasharguments to the Health center in 1.5dev. Please test and correct my English 
There is still room for improvement.
Somebody could also try to run IIS with PHP 4.3.11dev snapshot to test if slasharguments work in ISAPI mode.
skodak
Somebody could also try to run IIS with PHP 4.3.11dev snapshot to test if slasharguments work in ISAPI mode.
skodak
Re: Slasharguments test in Health center
Hi Petr,
On my home box (XP SP2, Apache 1, PHP 4.3.4) the test says that slashargs test failed. However, slasharguments work just fine!
I 'll try to find out why myself, given the time. Thanks for implementing this!
On my home box (XP SP2, Apache 1, PHP 4.3.4) the test says that slashargs test failed. However, slasharguments work just fine!
I 'll try to find out why myself, given the time. Thanks for implementing this!
Re: Slasharguments test in Health center
There might be a problem with fopen() reading data from url. There is some security switch in php.ini - could you check that? I could disable the test in that case.
see: allow_url_fopen = On
You can diagnose it more by looking at http://yoursite/file.php/test - if it shows "1" or "2", the problem is in fopen/fread. I should add a link to it when the url_fopen is disabled.
see: allow_url_fopen = On
You can diagnose it more by looking at http://yoursite/file.php/test - if it shows "1" or "2", the problem is in fopen/fread. I should add a link to it when the url_fopen is disabled.
Re: Slasharguments test in Health center
I might first try to read from file.php?file=/test and only then from file.php/test...
Re: Slasharguments test in Health center
allow_url_fopen = On
I am surprised that you, of all people, would suggest this setting!
I am surprised that you, of all people, would suggest this setting!
Re: Slasharguments test in Health center
It is "on" in php.ini-dist and php.ini-recommended - it is an extra bit of security for bad coders, but solves nothing in moodle - if there is a problem, you could read local files anyway. I have checked moodle code for possible problems with allow_url_fopen myself.
You can not enable https login when allow_url_fopen = off (see admin/config.php), right?
You can not enable https login when allow_url_fopen = off (see admin/config.php), right?
Re: Slasharguments test in Health center
As far as I can see there is no problem with allow_url_fopen. We should be pretty draconian about what arguments we pass to fopen() anyway, nothing should end up in there unless the filtering logic allows it. So opening URLs shouldn't be a security risk.
Edit: Petr, I think we were typing this at the same time
Edit: Petr, I think we were typing this at the same time