cvs: php4(PHP_4_0_7) / php.ini-recommended

derick Mon Mar 4 15:25:55 2002 EDT Modified files: (Branch: PHP_4_0_7) /php4 php.ini-recommended Log: - MFH for: document force-redirect in php.ini Index: php4/php.ini-recommended diff -u php4/php.ini-recommended:1.50.2.1 php4/php.ini-recommended:1.50.2.2 --- php4/php.ini-recommended:1.50.2.1 Fri Aug 17 12:54:16 2001 +++ php4/php.ini-recommended Mon Mar 4 15:25:54 2002 @@ -361,6 +361,10 @@ ;include_path = ".;c:\php\includes" ; The root of the PHP pages, used only if nonempty. +; if PHP was not compiled with FORCE_REDIRECT, you SHOULD set doc_root +; if you are running php as a CGI under any web server (other than IIS) +; see documentation for security issues. The alternate is to use the +; cgi.force_redirect configuration below doc_root = ; The directory under which PHP opens the script using /~usernamem used only @@ -374,6 +378,19 @@ ; properly in multithreaded servers, such as IIS or Zeus, and is automatically ; disabled on them. enable_dl = On + +; cgi.force_redirect is necessary to provide security running PHP as a CGI under +; most web servers. Left undefined, PHP turns this on by default. You can +; turn it off here AT YOUR OWN RISK +; **You CAN safely turn this off for IIS, in fact, you MUST.** +; cgi.force_redirect = 1 + +; if cgi.force_redirect is turned on, and you are not running under Apache or Netscape +; (iPlanet) web servers, you MAY need to set an environment variable name that PHP +; will look for to know it is OK to continue execution. Setting this variable MAY +; cause security issues, KNOW WHAT YOU ARE DOING FIRST. +; cgi.redirect_status_env = ; + ;;;;;;;;;;;;;;;;