#22001 [Com]: /php.ini is read instead of configured /usr/local/etc/php.ini !!!

ID: 22001 Comment by: joseluis dot perez at arrakis dot es Reported By: mdff at a1 dot net Status: Wont fix Bug Type: *Configuration Issues Operating System: Solaris 8 PHP Version: 4.3.0 New Comment: OS: Linux Debian 3.0, kernel 2.4.18. I can´t understand why you don´t plan to fix this 'feature'. It´s an important security risk. Ok, let´s try to explain my plataform. I have an Apache that serves many virtualHosts. I use suexec to control that cgi´s are run in the jail where all virtualhost are. Each virtualhost has a different uid , and CGI´s are run with it´s own uid. This way I can restrict my customer´s security and privacy. And that´s why it´s so important that PHP is run as CGI. I have compiled PHP with '--with-config-file-path=/etc' option. It worked correctly in the jail and I have a correct php.ini in '/etc'. In fact, PHP first look './php.ini' and then if it doesn´t exists, it reads /etc/php.ini. ( I used strace to see it ). I need PHP to run as a CGI, because I use it in Apache and I need it to generate HTML code, so I can´t compile it to work as CLI. I know that when you use -c option you can tell PHP where to look for php.ini, but when you run PHP in CGI mode, it overrides command line options. It´s a security matter. I use PHPRC to tell PHP where to look for php.ini for each of my virtualhosts, but when exists a php.ini file in the directory where the scripts resides PHP read it and ignore PHPRC, -c or compilation options. Feel free to ask any further information you need, and of course thanks in avdvance. Previous Comments: ------------------------------------------------------------------------ [2003-02-02 06:46:50] philip@php.net Added a link to this bug report in the related existing bug of #21783 so this information will be added to the manual sometime. http://bugs.php.net/bug.php?id=21783 ------------------------------------------------------------------------ [2003-02-02 05:50:38] mdff at a1 dot net yes... i understand how this is done... now. but: i did not find anything 'bout this behaviour in the manual... maybe i overread it, but it should be placed to be seen at 1st (bold, underline ;-)) maybe in: http://www.php.net/manual/en/configuration.php#configuration.file thx, md. ------------------------------------------------------------------------ [2003-02-01 19:42:39] edink@php.net This is a known issue. PHP searches for php.ini in current working directory first (exception to this is CLI SAPI) and apache does cd / at startup so /php.ini gets read. There are nó current plans to change this. ------------------------------------------------------------------------ [2003-02-01 17:09:10] msopacua@php.net Please try using this CVS snapshot: http://snaps.php.net/php4-STABLE-latest.tar.gz For Windows: http://snaps.php.net/win32/php4-win32-STABLE-latest.zip Could you also stop and start apache instead of restart? I can't reproduce this with current HEAD. ------------------------------------------------------------------------ [2003-02-01 15:50:50] mdff at a1 dot net hi, i saved a version of php.ini as "/php.ini", which should only be a copy before i changed my real one... then i tried to change my real php.ini (/usr/local/etc/php.ini) but the changes did NOT take effect (yes, i restarted my apache!) reading phpinfo() output, it told me that it read /php.ini instead of /usr/local/etc/php.ini, which is given in the compile options as default as you can see below: i compiled php-4.3.0 with the following options: ./configure \ --prefix=/usr/local \ --with-apxs=/data/apache/bin/apxs \ --enable-cli \ --disable-cgi \ --disable-debug \ --with-config-file-path=/usr/local/etc \ --with-exec-dir \ --enable-sigchild \ --disable-magic-quotes \ --disable-rpath \ --disable-ipv6 \ --with-openssl \ --disable-all \ --with-zlib=/usr/local \ --disable-ctype \ --with-curl=/usr/local \ --with-gd \ --with-jpeg-dir=/usr/local \ --with-png-dir=/usr/local \ --with-zlib-dir=/usr/local \ --with-freetype-dir=/usr/local \ --with-t1lib=/usr/local \ --enable-gd-native-ttf \ --with-gettext=/usr/local \ --with-imap=/usr/local \ --with-imap-ssl=/usr/local \ --with-ldap=/usr/local \ --with-mcrypt=/usr/local \ --with-mysql=/usr/local \ --with-oci8=/data/oracle \ --with-pcre-regex \ --disable-posix \ --enable-session \ --enable-sockets \ --enable-sysvmsg \ --enable-sysvsem \ --enable-sysvshm \ --enable-xml \ --with-expat-dir=/usr/local \ --enable-shared \ --enable-static \ --disable-inline-optimization \ snippet output from phpinfo(): phpinfo() PHP Version => 4.3.0 System => SunOS test01 5.8 Generic_108528-18 sun4u Build Date => Jan 31 2003 21:09:32 Configure Command => './configure' '--prefix=/usr/local' '--with-apxs=/data/apache/bin/apxs' '--enable-cli' '--disable-cgi' '--disable-debug' '--with-config-file-path=/usr/local/etc' '--with-exec-dir' '--enable-sigchild' '--disable-magic-quotes' '--disable-rpath' '--disable-ipv6' '--with-openssl' '--disable-all' '--with-zlib=/usr/local' '--disable-ctype' '--with-curl=/usr/local' '--with-gd' '--with-jpeg-dir=/usr/local' '--with-png-dir=/usr/local' '--with-zlib-dir=/usr/local' '--with-freetype-dir=/usr/local' '--with-t1lib=/usr/local' '--enable-gd-native-ttf' '--with-gettext=/usr/local' '--with-imap=/usr/local' '--with-imap-ssl=/usr/local' '--with-ldap=/usr/local' '--with-mcrypt=/usr/local' '--with-mysql=/usr/local' '--with-oci8=/data/oracle' '--with-pcre-regex' '--disable-posix' '--enable-session' '--enable-sockets' '--enable-sysvmsg' '--enable-sysvsem' '--enable-sysvshm' '--enable-xml' '--with-expat-dir=/usr/local' '--enable-shared' '--enable-static' '--disable-inline-optimization' Server API => Apache Virtual Directory Support => disabled Configuration File (php.ini) Path => /php.ini PHP API => 20020918 PHP Extension => 20020429 Zend Extension => 20021010 Debug Build => no Thread Safety => disabled Registered PHP Streams => php, http, ftp, https, ftps, compress.zlib ok guys, there seems to be a bug anywhere... i removed the /php.ini as a workaround, and now it takes my /usr/local/etc/php.ini, like i told php to do at compile time. funny thing, eh? br, md. ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=22001&edit=1