« Profile field values lost when edited
WebGet and open_basedir
SMF bug 4873 (agreement not shown, no error, if agreement.tx… »

live627

  • Should five per cent appear too small / Be thankful I don't take it all / 'Cause I'm the taxman, yeah I'm the taxman
  • Posts: 1,670
WebGet and open_basedir
« on August 1st, 2012, 06:31 AM »
On the last page of the installer, I see some of these errors:


Warning: curl_setopt() [function.curl-setopt]: CURLOPT_FOLLOWLOCATION cannot be activated when safe_mode is enabled or an open_basedir is set in ./Sources/Class-WebGet.php on line 150
A confident man keeps quiet.whereas a frightened man keeps talking, hiding his fear.

Arantor

  • As powerful as possible, as complex as necessary.
  • Posts: 14,278
Re: WebGet and open_basedir
« Reply #1, on August 1st, 2012, 02:51 PM »
There's actually a fix documented on php.net for this, and I'll implement it when I have time, but I have to say while I can understand the restriction in the stupid 'safe mode', I have no idea why it's restricted with open_basedir.
When we unite against a common enemy that attacks our ethos, it nurtures group solidarity. Trolls are sensational, yes, but we keep everyone honest. | Game Memorial

Norodo

  • Oh you Baidu, so randumb. (60 sites being indexed at once? Jeez)
  • Posts: 469
Re: WebGet and open_basedir
« Reply #2, on August 1st, 2012, 03:05 PM »
Safe mode is so annoying. I had to deal with it all of the time when I had NFSNET as my host. It's pretty much their only drawback for me.

Arantor

  • As powerful as possible, as complex as necessary.
  • Posts: 14,278
Re: WebGet and open_basedir
« Reply #3, on August 1st, 2012, 03:11 PM »
It has been dropped from later PHP releases simply because it doesn't actually add anything useful as far as safety goes.

Nao

  • Dadman with a boy
  • Posts: 16,082
Re: WebGet and open_basedir
« Reply #4, on August 1st, 2012, 04:01 PM »
Well, even after the good ol' days of Safe Mode, remember how we got mod_security for Apache, the infamous module that would crash on you if you dared to enter ";id=" in the URL...? :P

Arantor

  • As powerful as possible, as complex as necessary.
  • Posts: 14,278
Re: WebGet and open_basedir
« Reply #5, on August 1st, 2012, 04:03 PM »
There are way more rules in mod_security than that. Some of the configurations are downright weird, too.

(Yes, the host can actually configure what shows up in mod_security. I remember one host who used to actually kick back *any* requested URL with ; in it. Guess how that worked out for him.)

Dragooon

  • I can code! Really!
  • polygon.com has to be one of the best sites I've seen recently.
  • Posts: 1,841
Re: WebGet and open_basedir
« Reply #6, on August 1st, 2012, 06:41 PM »
Quote from Nao on August 1st, 2012, 04:01 PM
Well, even after the good ol' days of Safe Mode, remember how we got mod_security for Apache, the infamous module that would crash on you if you dared to enter ";id=" in the URL...? :P
That's why you changed AeMe to use ;in= :o, never knew that.
The way it's meant to be

Arantor

  • As powerful as possible, as complex as necessary.
  • Posts: 14,278

Nao

  • Dadman with a boy
  • Posts: 16,082
Re: WebGet and open_basedir
« Reply #8, on August 1st, 2012, 07:38 PM »
Quote from Dragooon on August 1st, 2012, 06:41 PM
That's why you changed AeMe to use ;in= :o, never knew that.
Yup, was tired of the fake "bug reports"...
SMF did it by changing 'id' to 'tid' or whatever was the first letter of their variable (topic, message...), I decided to adopt a single name that would stand for 'id number' and just replace 'id'... Happy with it.

Arantor

  • As powerful as possible, as complex as necessary.
  • Posts: 14,278
Re: WebGet and open_basedir
« Reply #9, on February 20th, 2013, 02:51 AM »
Bumping to remind myself to fix this. I do now know and understand why it is in place, I just haven't implemented it yet.
« Profile field values lost when edited
SMF bug 4873 (agreement not shown, no error, if agreement.tx… »