Session error with PHP 5.2.4 Suhosin

Pandos

  • Living on the edge of Wedge
  • Posts: 635
Session error with PHP 5.2.4 Suhosin
« on November 2nd, 2012, 02:41 PM »
Unable to login as admin again. System reports:
Code: [Select]
suhosin[21222]: ALERT - configured request variable name length limit exceeded - dropped variable 'dd78fbbd1142=571e996b1fe103bebe1556b15d450505=571e996b1fe103bebe1556b15d450505=571e996b1fe103bebe1556b15d450505' (attacker '127.0.0.1', file '/.../.../.../.../index.php')

# dpkg-reconfigure brain
error: brain is not installed or configured

Arantor

  • As powerful as possible, as complex as necessary.
  • Posts: 14,278
Re: Session error with PHP 5.2.4 Suhosin
« Reply #1, on November 2nd, 2012, 04:00 PM »
Curious. The variable is getting the session id inserted 3 times. Is this on the password confirmation form?

(And why is it marked as solved?)
When we unite against a common enemy that attacks our ethos, it nurtures group solidarity. Trolls are sensational, yes, but we keep everyone honest. | Game Memorial

Pandos

  • Living on the edge of Wedge
  • Posts: 635
Re: Session error with PHP 5.2.4 Suhosin
« Reply #2, on November 2nd, 2012, 04:04 PM »
*lol* try to insert code for php.ini in this post and it gives me an error about mismatced bbcode ;)


Just needet to edit some settings in php.ini to allow suhosin more vars

Arantor

  • As powerful as possible, as complex as necessary.
  • Posts: 14,278
Re: Session error with PHP 5.2.4 Suhosin
« Reply #3, on November 2nd, 2012, 04:06 PM »
There's a bigger problem - there is nowhere that that code should be generated, which means there is still a problem - fixing php.ini like that doesn't solve the problem, it just hides it.

Pandos

  • Living on the edge of Wedge
  • Posts: 635
Re: Session error with PHP 5.2.4 Suhosin
« Reply #4, on November 2nd, 2012, 04:16 PM »
OK, removed Topic  solved :)
For those who are interested:
edit php.ini and add the following:


; For translation manager to handle more inputs
suhosin.post.max_vars = 2000suhosin.
request.max_vars = 2000
; For URL handling
suhosin.request.max_totalname_length = 300
suhosin.request.max_varname_length = 300
suhosin.get.max_varname_length = 300
suhosin.get.max_name_length = 300

Arantor

  • As powerful as possible, as complex as necessary.
  • Posts: 14,278
Re: Session error with PHP 5.2.4 Suhosin
« Reply #5, on November 2nd, 2012, 04:26 PM »
That doesn't solve the problem. That just masks it. But I have no idea what is generating the extra code - because I just checked and unless I'm doing something different to you (and I have no idea, you never told me how you had this error), I can't reproduce it.

Pandos

  • Living on the edge of Wedge
  • Posts: 635
Re: Session error with PHP 5.2.4 Suhosin
« Reply #6, on November 2nd, 2012, 04:31 PM »
This occured directly after enabling PrettyURLs. System told me to enter admin pass and output was the above.
So disabled PrettyURLs manually in DB but the error was still there.


Then i went to modify my php.ini and now it works.