Wedge

Public area => The Pub => Bug reports => Topic started by: live627 on August 1st, 2012, 06:31 AM

Title: WebGet and open_basedir
Post by: live627 on August 1st, 2012, 06:31 AM
On the last page of the installer, I see some of these errors:


Warning: curl_setopt() [function.curl-setopt]: CURLOPT_FOLLOWLOCATION cannot be activated when safe_mode is enabled or an open_basedir is set in ./Sources/Class-WebGet.php on line 150
Title: Re: WebGet and open_basedir
Post by: Arantor on August 1st, 2012, 02:51 PM
There's actually a fix documented on php.net for this, and I'll implement it when I have time, but I have to say while I can understand the restriction in the stupid 'safe mode', I have no idea why it's restricted with open_basedir.
Title: Re: WebGet and open_basedir
Post by: Norodo on August 1st, 2012, 03:05 PM
Safe mode is so annoying. I had to deal with it all of the time when I had NFSNET as my host. It's pretty much their only drawback for me.
Title: Re: WebGet and open_basedir
Post by: Arantor on August 1st, 2012, 03:11 PM
It has been dropped from later PHP releases simply because it doesn't actually add anything useful as far as safety goes.
Title: Re: WebGet and open_basedir
Post by: Nao on August 1st, 2012, 04:01 PM
Well, even after the good ol' days of Safe Mode, remember how we got mod_security for Apache, the infamous module that would crash on you if you dared to enter ";id=" in the URL...? :P
Title: Re: WebGet and open_basedir
Post by: Arantor on August 1st, 2012, 04:03 PM
There are way more rules in mod_security than that. Some of the configurations are downright weird, too.

(Yes, the host can actually configure what shows up in mod_security. I remember one host who used to actually kick back *any* requested URL with ; in it. Guess how that worked out for him.)
Title: Re: WebGet and open_basedir
Post by: Dragooon on August 1st, 2012, 06:41 PM
Quote from Nao on August 1st, 2012, 04:01 PM
Well, even after the good ol' days of Safe Mode, remember how we got mod_security for Apache, the infamous module that would crash on you if you dared to enter ";id=" in the URL...? :P
That's why you changed AeMe to use ;in= :o, never knew that.
Title: Re: WebGet and open_basedir
Post by: Arantor on August 1st, 2012, 07:20 PM
Yup, that's the reason it was changed.
Title: Re: WebGet and open_basedir
Post by: Nao on August 1st, 2012, 07:38 PM
Quote from Dragooon on August 1st, 2012, 06:41 PM
That's why you changed AeMe to use ;in= :o, never knew that.
Yup, was tired of the fake "bug reports"...
SMF did it by changing 'id' to 'tid' or whatever was the first letter of their variable (topic, message...), I decided to adopt a single name that would stand for 'id number' and just replace 'id'... Happy with it.
Title: Re: WebGet and open_basedir
Post by: Arantor on February 20th, 2013, 02:51 AM
Bumping to remind myself to fix this. I do now know and understand why it is in place, I just haven't implemented it yet.