cvs: /phpdoc/chapters config.sgml copyright.sgml install.sgml security.sgml

cslawi Wed Oct 20 18:46:55 1999 EDT Modified files: /phpdoc/chapters config.sgml copyright.sgml install.sgml security.sgml Log: Normalized according to the DocBook 3.1 DTD. This mostly just adds closing tags and attribute quotes, but lets a stock 3.1 install compile the PHP docs. It still compiles with DocBook 3.0, as well. Index: phpdoc/chapters/config.sgml diff -u phpdoc/chapters/config.sgml:1.7 phpdoc/chapters/config.sgml:1.8 --- phpdoc/chapters/config.sgml:1.7 Tue Sep 21 17:45:16 1999 +++ phpdoc/chapters/config.sgml Wed Oct 20 18:46:55 1999 @@ -9,17 +9,17 @@ PHP 3.0, and simply <filename>php.ini</filename> as of PHP 4.0) is read when PHP starts up. For the server module versions of PHP, this happens only once when the web server is started. For the - <acronym>CGI</acronym> version, it happens on every invocation. + <acronym>CGI</acronym> version, it happens on every invocation.</simpara> <simpara> When using PHP as an Apache module, you can also change the configuration settings using directives in Apache configuration - files and .htaccess files. + files and .htaccess files.</simpara> <simpara> With PHP 3.0, there are Apache directives that correspond to each configuration setting in the <filename>php3.ini</filename> name, - except the name is prefixed by "php3_". + except the name is prefixed by "php3_".</simpara> <para> With PHP 4.0, there are just a few Apache directives that allow you @@ -33,7 +33,7 @@ </term> <listitem> <para> - This sets the value of the specified variable. + This sets the value of the specified variable.</para> </listitem> </varlistentry> <varlistentry> @@ -44,7 +44,7 @@ </term> <listitem> <para> - This is used to set a Boolean configuration option. + This is used to set a Boolean configuration option.</para> </listitem> </varlistentry> <varlistentry> @@ -58,7 +58,7 @@ This sets the value of the specified variable. "Admin" configuration settings can only be set from within the main Apache configuration files, and not from .htaccess - files. + files.</para> </listitem> </varlistentry> <varlistentry> @@ -69,16 +69,16 @@ </term> <listitem> <para> - This is used to set a Boolean configuration option. + This is used to set a Boolean configuration option.</para> </listitem> </varlistentry> - </variablelist> + </variablelist></para> <simpara> You can view the settings of the configuration values in the output of <function>phpinfo</function>. You can also access the values of individial configuration settings using - <function>get_cfg_var</function>. + <function>get_cfg_var</function>.</simpara> <sect2 id="ini.sect.general"> <title>General Configuration Directives</title> @@ -95,8 +95,7 @@ Enables the use of ASP-like &lt;% %&gt; tags in addition to the usual &lt;?php ?&gt; tags. This includes the variable-value printing shorthand of &lt;%= $value %&gt;. For - more information, see <link - linkend="language.basic-syntax.phpmode">Escaping from HTML</link>. + more information, see <link linkend="language.basic-syntax.phpmode">Escaping from HTML</link>. </simpara> <note> @@ -116,15 +115,14 @@ Specifies the name of a file that is automatically parsed after the main file. The file is included as if it was called with the <function>include</function> function, so - <link linkend="ini.include-path">include_path</link> is used. + <link linkend="ini.include-path">include_path</link> is used.</para> <para> - The special value <systemitem - class="constant">none</systemitem> disables auto-appending. + The special value <systemitem class="constant">none</systemitem> disables auto-appending. <note> <simpara> If the script is terminated with <function>exit</function>, - auto-append will <emphasis>not</emphasis> occur. - </note> + auto-append will <emphasis>not</emphasis> occur.</simpara> + </note></para> </listitem> </varlistentry> @@ -138,10 +136,9 @@ Specifies the name of a file that is automatically parsed before the main file. The file is included as if it was called with the <function>include</function> function, so - <link linkend="ini.include-path">include_path</link> is used. + <link linkend="ini.include-path">include_path</link> is used.</para> <para> - The special value <systemitem - class="constant">none</systemitem> disables auto-prepending. + The special value <systemitem class="constant">none</systemitem> disables auto-prepending.</para> </listitem> </varlistentry> @@ -177,8 +174,7 @@ <listitem> <para> PHP's "root directory" on the server. Only used if - non-empty. If PHP is configured with <link - linkend="ini.safe-mode">safe mode</link>, no files outside + non-empty. If PHP is configured with <link linkend="ini.safe-mode">safe mode</link>, no files outside this directory are served. </para> </listitem> @@ -213,7 +209,7 @@ special value <literal>syslog</literal> is used, the errors are sent to the system logger instead. On UNIX, this means syslog(3) and on Windows NT it means the event log. The - system logger is not supported on Windows 95. + system logger is not supported on Windows 95.</para> </listitem> </varlistentry> @@ -344,18 +340,18 @@ colon in UNIX or semicolon in Windows. <example> <title>UNIX include_path</title> - <programlisting role=php3.ini> + <programlisting role="php3.ini"> include_path=.:/home/httpd/php-lib </programlisting> </example> <example> <title>Windows include_path</title> - <programlisting role=php3.ini> + <programlisting role="php3.ini"> include_path=".;c:\www\phplib" </programlisting> </example> The default value for this directive is <literal>.</literal> - (only the current directory). + (only the current directory).</para> </listitem> </varlistentry> @@ -378,7 +374,7 @@ <listitem> <para> Tells whether script error messages should be logged to the - server's error log. This option is thus server-specific. + server's error log. This option is thus server-specific.</para> </listitem> </varlistentry> @@ -482,7 +478,7 @@ PHP's open tag should be allowed. If you want to use PHP in combination with XML, you have to disable this option. If disabled, you must use the long form of the open tag - (<userinput>&lt;?php ?></userinput>). + (<userinput>&lt;?php ?></userinput>).</para> </listitem> </varlistentry> @@ -505,7 +501,7 @@ <listitem> <para> If enabled, the last error message will always be present in the - global variable <symbol>$php_errormsg</symbol>. + global variable <symbol>$php_errormsg</symbol>.</para> </listitem> </varlistentry> @@ -519,7 +515,7 @@ If enabled, GET, POST and cookie input can be found in the global associative arrays <symbol>$HTTP_GET_VARS</symbol>, <symbol>$HTTP_POST_VARS</symbol> and - <symbol>$HTTP_COOKIE_VARS</symbol>, respectively. + <symbol>$HTTP_COOKIE_VARS</symbol>, respectively.</para> </listitem> </varlistentry> @@ -532,7 +528,7 @@ <para> The temporary directory used for storing files when doing file upload. Must be writable by whatever user PHP is - running as. + running as.</para> </listitem> </varlistentry> @@ -545,7 +541,7 @@ <para> The base name of the directory used on a user's home directory for PHP files, for example - <literal>public_html</literal>. + <literal>public_html</literal>.</para> </listitem> </varlistentry> @@ -560,7 +556,7 @@ plus (<literal>+</literal>) operator is used on strings. This is to make it easier to find scripts that need to be rewritten to using the string concatenator instead - (<literal>.</literal>). + (<literal>.</literal>).</para> </listitem> </varlistentry> @@ -581,7 +577,7 @@ <para> DNS name or IP address of the SMTP server PHP under Windows should use for mail sent with the <function>mail</function> - function. + function.</para> </listitem> </varlistentry> @@ -593,7 +589,7 @@ <listitem> <para> Which "From:" mail address should be used in mail sent from - PHP under Windows. + PHP under Windows.</para> </listitem> </varlistentry> @@ -609,13 +605,13 @@ <filename>/usr/lib/sendmail</filename> <command>configure</command> does an honest attempt of locating this one for you and set a default, but if it fails, - you can set it here. + you can set it here.</para> <para> Systems not using sendmail should set this directive to the sendmail wrapper/replacement their mail system offers, if any. For example, <ulink url="http://www.qmail.org/">Qmail</ulink> users can normally set it to - <filename>/var/qmail/bin/sendmail</filename>. + <filename>/var/qmail/bin/sendmail</filename>.</para> </listitem> </varlistentry> @@ -633,9 +629,8 @@ </term> <listitem> <para> - Whether to enable PHP's safe mode. Read the <link - linkend="security">Security chapter</link> for more - more information. + Whether to enable PHP's safe mode. Read the <link linkend="security">Security chapter</link> for more + more information.</para> </listitem> </varlistentry> @@ -648,7 +643,7 @@ <para> If PHP is used in safe mode, <function>system</function> and the other functions executing system programs refuse to start - programs that are not in this directory. + programs that are not in this directory.</para> </listitem> </varlistentry> @@ -666,7 +661,7 @@ </term> <listitem> <para> - DNS name or IP address of host used by the debugger. + DNS name or IP address of host used by the debugger.</para> </listitem> </varlistentry> @@ -677,7 +672,7 @@ </term> <listitem> <para> - Port number used by the debugger. + Port number used by the debugger.</para> </listitem> </varlistentry> @@ -688,7 +683,7 @@ </term> <listitem> <para> - Whether the debugger is enabled. + Whether the debugger is enabled.</para> </listitem> </varlistentry> @@ -732,7 +727,7 @@ <listitem> <para> In what directory PHP should look for dynamically loadable - extensions. + extensions.</para> </listitem> </varlistentry> @@ -744,7 +739,7 @@ <listitem> <para> Which dynamically loadable extensions to load when PHP starts - up. + up.</para> </listitem> </varlistentry> @@ -762,7 +757,7 @@ </term> <listitem> <para> - Whether to allow persistent MySQL connections. + Whether to allow persistent MySQL connections.</para> </listitem> </varlistentry> Index: phpdoc/chapters/copyright.sgml diff -u phpdoc/chapters/copyright.sgml:1.1 phpdoc/chapters/copyright.sgml:1.2 --- phpdoc/chapters/copyright.sgml:1.1 Sun Jun 6 14:50:33 1999 +++ phpdoc/chapters/copyright.sgml Wed Oct 20 18:46:55 1999 @@ -4,24 +4,24 @@ <simpara> PHP 3.0 is copyright (C) 1997 the PHP Development Team. The members of this team are listed in the CREDITS file that comes with - the PHP 3.0 source distribution. + the PHP 3.0 source distribution.</simpara> <simpara> PHP 3.0 is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your - option) any later version. + option) any later version.</simpara> <simpara> PHP 3.0 is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - General Public License for more details. + General Public License for more details.</simpara> <simpara> You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software - Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.</simpara> </chapter> Index: phpdoc/chapters/install.sgml diff -u phpdoc/chapters/install.sgml:1.10 phpdoc/chapters/install.sgml:1.11 --- phpdoc/chapters/install.sgml:1.10 Tue Sep 21 04:51:34 1999 +++ phpdoc/chapters/install.sgml Wed Oct 20 18:46:55 1999 @@ -6,8 +6,7 @@ <simpara> The source code, and binary distributions for some platforms (including Windows), can be found at - <literal><ulink - url="http://www.php.net/">http://www.php.net/</ulink></literal>. + <literal><ulink url="http://www.php.net/">http://www.php.net/</ulink></literal>.</simpara> </sect1> <sect1 id="install-unix"> @@ -85,24 +84,24 @@ Using the "setup" script that comes with PHP. This script asks you a series of questions (almost like the "install" script of PHP/FI 2.0) and runs "configure" in the end. To run - this script, type <command>./setup</command>. + this script, type <command>./setup</command>.</para> <para> This script will also create a file called "do-conf", this file will contain the options passed to configure. You can edit this file to change just a few options without having to re-run setup. Then type <command>./do-conf</command> to run - configure with the new options. + configure with the new options.</para> </listitem> <listitem> <para> Running configure by hand. To see what options you have, type - <command>./configure --help</command>. + <command>./configure --help</command>.</para> </listitem> - </itemizedlist> + </itemizedlist></para> <para> Details about some of the different configuration options are - listed below. + listed below.</para></sect2> <sect2 id="with-apache"> <title>Apache module</title> @@ -113,10 +112,9 @@ --with-apache</link>=<replaceable>DIR</replaceable></option> option to configure) and specify the Apache distribution base directory. If you have unpacked your Apache distribution in - <filename class=directory>/usr/local/www/apache_1.2.4</filename>, + <filename class="directory">/usr/local/www/apache_1.2.4</filename>, this is your Apache distribution base directory. The default - directory is <filename - class=directory>/usr/local/etc/httpd</filename>. + directory is <filename class="directory">/usr/local/etc/httpd</filename>.</para></sect2> <sect2 id="with-fhttpd"> <title>fhttpd module</title> @@ -126,10 +124,9 @@ fhttpd module?" (the <option><link linkend="with-fhttpd"> --with-fhttpd</link>=<replaceable>DIR</replaceable></option> option to configure) and specify the fhttpd source base - directory. The default directory is <filename - class=directory>/usr/local/src/fhttpd</filename>. If you are + directory. The default directory is <filename class="directory">/usr/local/src/fhttpd</filename>. If you are running fhttpd, building PHP as a module will give better - performance, more control and remote execution capability. + performance, more control and remote execution capability.</para></sect2> <sect2 id="install-cgi"> <title>CGI version</title> @@ -141,14 +138,14 @@ the CGI version enables Apache users to run different PHP-enabled pages under different user-ids. Please make sure you read through the <link linkend="security">Security - chapter</link> if you are going to run PHP as a CGI. + chapter</link> if you are going to run PHP as a CGI.</para></sect2> <sect2> <title>Database Support Options</title> <para> PHP has native support for a number of databases (as well as - ODBC): + ODBC):</para> <sect3 id="with-adabas"> @@ -158,10 +155,9 @@ </synopsis> <simpara> Compiles with Adabas D support. The parameter is the Adabas D - install directory and defaults to <filename - class=directory>/usr/local/adabasd</filename>. + install directory and defaults to <filename class="directory">/usr/local/adabasd</filename>.</simpara> <simpara> - <ulink url="http://www.adabas.com/">Adabas home page</ulink> + <ulink url="http://www.adabas.com/">Adabas home page</ulink></simpara> </sect3> <sect3 id="with-dbase"> @@ -171,7 +167,7 @@ </synopsis> <simpara> Enables the bundled DBase support. No external libraries are - required. + required.</simpara> </sect3> <sect3 id="with-filepro"> @@ -181,7 +177,7 @@ </synopsis> <simpara> Enables the bundled read-only filePro support. No external - libraries are required. + libraries are required.</simpara> </sect3> <sect3 id="with-msql"> @@ -191,19 +187,18 @@ </synopsis> <simpara> Enables mSQL support. The parameter to this option is the mSQL - install directory and defaults to <filename - class=directory>/usr/local/Hughes</filename>. This is the + install directory and defaults to <filename class="directory">/usr/local/Hughes</filename>. This is the default directory of the mSQL 2.0 distribution. <command>configure</command> automatically detects which mSQL version you are running and PHP supports both 1.0 and 2.0, but if you compile PHP with mSQL 1.0, you can only access mSQL 1.0 - databases, and vice-versa. + databases, and vice-versa.</simpara> <simpara> See also <link linkend="ini.sect.msql">mSQL Configuration</link> Directives in the <link linkend="configuration.file">configuration - file</link>. + file</link>.</simpara> <simpara> - <ulink url="http://www.hughes.com.au">mSQL home page</ulink> + <ulink url="http://www.hughes.com.au">mSQL home page</ulink></simpara> </sect3> <sect3 id="with-mysql"> @@ -213,15 +208,13 @@ </synopsis> <simpara> Enables MySQL support. The parameter to this option is the - MySQL install directory and defaults to <filename - class=directory>/usr/local</filename>. This is the default - installation directory of the MySQL distribution. + MySQL install directory and defaults to <filename class="directory">/usr/local</filename>. This is the default + installation directory of the MySQL distribution.</simpara> <simpara> See also <link linkend="ini.sect.mysql">MySQL - Configuration</link> Directives in the <link - linkend="configuration.file">configuration file</link>. + Configuration</link> Directives in the <link linkend="configuration.file">configuration file</link>.</simpara> <simpara> - <ulink url="http://www.tcx.se">MySQL home page</ulink> + <ulink url="http://www.tcx.se">MySQL home page</ulink></simpara> </sect3> <sect3 id="with-iodbc"> @@ -234,10 +227,10 @@ iODBC Driver Manager, a freely redistributable ODBC driver manager which runs under many flavors of UNIX. The parameter to this option is the iODBC installation directory and defaults to - <filename class=directory>/usr/local</filename>. + <filename class="directory">/usr/local</filename>.</simpara> <simpara> <ulink url="http://users.ids.net/~bjepson/freeODBC/">FreeODBC - home page</ulink> + home page</ulink></simpara> </sect3> <sect3 id="with-openlink"> @@ -248,10 +241,10 @@ <simpara> Includes OpenLink ODBC support. The parameter to this option is the OpenLink ODBC installation directory and defaults to - <filename class=directory>/usr/local/openlink</filename>. + <filename class="directory">/usr/local/openlink</filename>.</simpara> <simpara> <ulink url="http://www.openlinksw.com/">OpenLink Software's home - page</ulink> + page</ulink></simpara> </sect3> <sect3 id="with-oracle"> @@ -264,9 +257,9 @@ at least with Oracle versions 7.0 through 7.3. The parameter is the <envar>ORACLE_HOME</envar> directory. You do not have to specify this parameter if your Oracle environment has been set - up. + up.</simpara> <simpara> - <ulink url="http://www.oracle.com">Oracle home page</ulink> + <ulink url="http://www.oracle.com">Oracle home page</ulink></simpara> </sect3> <sect3 id="with-pgsql"> @@ -276,15 +269,13 @@ </synopsis> <simpara> Includes PostgreSQL support. The parameter is the PostgreSQL - base install directory and defaults to <filename - class=directory>/usr/local/pgsql</filename>. + base install directory and defaults to <filename class="directory">/usr/local/pgsql</filename>.</simpara> <simpara> See also <link linkend="ini.sect.pgsql">Postgres - Configuration</link> Directives in the <link - linkend="configuration.file">configuration file</link>. + Configuration</link> Directives in the <link linkend="configuration.file">configuration file</link>.</simpara> <simpara> <ulink url="http://www.postgreSQL.org/">PostgreSQL home - page</ulink> + page</ulink></simpara> </sect3> <sect3 id="with-solid"> @@ -294,10 +285,9 @@ </synopsis> <simpara> Includes Solid support. The parameter is the Solid install - directory and defaults to <filename - class=directory>/usr/local/solid</filename>. + directory and defaults to <filename class="directory">/usr/local/solid</filename>.</simpara> <simpara> - <ulink url="http://www.solidtech.com">Solid home page</ulink> + <ulink url="http://www.solidtech.com">Solid home page</ulink></simpara> </sect3> <sect3 id="with-sybase"> @@ -307,14 +297,12 @@ </synopsis> <simpara> Includes Sybase support. The parameter is the Sybase install - directory and defaults to <filename - class=directory>/home/sybase</filename>. + directory and defaults to <filename class="directory">/home/sybase</filename>.</simpara> <simpara> See also <link linkend="ini.sect.sybase">Sybase - Configuration</link> Directives in the <link - linkend="configuration.file">configuration file</link>. + Configuration</link> Directives in the <link linkend="configuration.file">configuration file</link>.</simpara> <simpara> - <ulink url="http://www.sybase.com">Sybase home page</ulink> + <ulink url="http://www.sybase.com">Sybase home page</ulink></simpara> </sect3> <sect3 id="with-sybase-ct"> @@ -324,12 +312,10 @@ </synopsis> <simpara> Includes Sybase-CT support. The parameter is the Sybase-CT - install directory and defaults to <filename - class=directory>/home/sybase</filename>. + install directory and defaults to <filename class="directory">/home/sybase</filename>.</simpara> <simpara> See also <link linkend="ini.sect.sybct">Sybase-CT - Configuration</link> Directives in the <link - linkend="configuration.file">configuration file</link>. + Configuration</link> Directives in the <link linkend="configuration.file">configuration file</link>.</simpara> </sect3> <sect3 id="with-velocis"> @@ -339,10 +325,9 @@ </synopsis> <simpara> Includes Velocis support. The parameter is the Velocis install - directory and defaults to <filename - class=directory>/usr/local/velocis</filename>. + directory and defaults to <filename class="directory">/usr/local/velocis</filename>.</simpara> <simpara> - <ulink url="http://www.raima.com">Velocis home page</ulink> + <ulink url="http://www.raima.com">Velocis home page</ulink></simpara> </sect3> <sect3 id="with-custom-odbc"> @@ -352,22 +337,21 @@ </synopsis> <simpara> Includes support for an arbitrary custom ODBC library. The - parameter is the base directory and defaults to <filename - class=directory>/usr/local</filename>. + parameter is the base directory and defaults to <filename class="directory">/usr/local</filename>.</simpara> <simpara> This option implies that you have defined CUSTOM_ODBC_LIBS when you run the configure script. You also must have a valid odbc.h header somewhere in your include path. If you don't have one, create it and include your specific header from there. Your header may also require some extra definitions, particularly - when it is multiplatform. Define them in CFLAGS. + when it is multiplatform. Define them in CFLAGS.</simpara> <simpara> For example, you can use Sybase SQL Anywhere on QNX as following: <literal> CFLAGS=-DODBC_QNX LDFLAGS=-lunix CUSTOM_ODBC_LIBS="-ldblib -lodbc" ./configure --with-custom-odbc=/usr/lib/sqlany50 - </literal> + </literal></simpara> </sect3> <sect3 id="disable-unified-odbc"> @@ -383,16 +367,10 @@ Anywhere. Requires that one (and only one) of these modules or the Velocis module is enabled, or a custom ODBC library specified. This option is only applicable if one of the - following options is used: <link - linkend="with-iodbc">--with-iodbc</link>, <link - linkend="with-solid">--with-solid</link>, <link - linkend="with-adabas">--with-adabas</link>, <link - linkend="with-velocis">--with-velocis</link>, or <link - linkend="with-adabas">--with-custom-odbc</link>, + following options is used: <link linkend="with-iodbc">--with-iodbc</link>, <link linkend="with-solid">--with-solid</link>, <link linkend="with-adabas">--with-adabas</link>, <link linkend="with-velocis">--with-velocis</link>, or <link linkend="with-adabas">--with-custom-odbc</link>,</simpara> <simpara> See also <link linkend="ini.sect.uodbc">Unified ODBC - Configuration</link> Directives in the <link - linkend="configuration.file">configuration file</link>. + Configuration</link> Directives in the <link linkend="configuration.file">configuration file</link>.</simpara> </sect3> <sect3 id="with-ldap"> @@ -403,13 +381,10 @@ <simpara> Includes <acronym>LDAP</acronym> (Lightweight Directory Access Protocol) support. The parameter is the LDAP base install - directory, defaults to <filename - class=directory>/usr/local/ldap</filename>. + directory, defaults to <filename class="directory">/usr/local/ldap</filename>.</simpara> <simpara> - More information about LDAP can be found in <ulink - url="ftp://ftp.isi.edu/in-notes/rfc1777.txt">RFC1777</ulink> and - <ulink - url="ftp://ftp.isi.edu/in-notes/rfc1778.txt">RFC1778</ulink>. + More information about LDAP can be found in <ulink url="ftp://ftp.isi.edu/in-notes/rfc1777.txt">RFC1777</ulink> and + <ulink url="ftp://ftp.isi.edu/in-notes/rfc1778.txt">RFC1778</ulink>.</simpara> </sect3> </sect2> @@ -423,8 +398,7 @@ <option>--with-mcrypt</option> </synopsis> <simpara> - Include support for the mcrypt library. See the <link - linkend="ref.mcrypt">mcrypt documentation</link> for more information. If + Include support for the mcrypt library. See the <link linkend="ref.mcrypt">mcrypt documentation</link> for more information. If you use the optional <replaceable>DIR</replaceable> argument, PHP will look for mcrypt.h in <replaceable>DIR</replaceable>/include. </simpara> @@ -474,7 +448,7 @@ </synopsis> <simpara> Turns on extra dependencies and compiler warnings used by some - of the PHP developers. + of the PHP developers.</simpara> </sect3> <sect3 id="with-system-regex"> @@ -488,7 +462,7 @@ must use the same library when building PHP as when linking the server. Enable this if the system's library provides special features you need. It is recommended that you use the bundled - library if possible. + library if possible.</simpara> </sect3> <sect3 id="with-config-file-path"> @@ -498,7 +472,7 @@ </synopsis> <simpara> The path used to look for <link linkend="configuration.file">the configuration - file</link> when PHP starts up. + file</link> when PHP starts up.</simpara> </sect3> <sect3 id="with-exec-dir"> @@ -508,11 +482,11 @@ </synopsis> <simpara> Only allow running of executables in DIR when in safe mode. - Defaults to <filename class=directory>/usr/local/bin</filename>. + Defaults to <filename class="directory">/usr/local/bin</filename>. This option only sets the default, it may be changed with the <link linkend="ini.safe-mode-exec-dir">safe_mode_exec_dir</link> directive in the <link linkend="configuration.file">configuration - file</link> later. + file</link> later.</simpara> </sect3> <sect3 id="enable-debug"> @@ -524,7 +498,7 @@ Enables extra debug information. This makes it possible to gather more detailed information when there are problems with PHP. (Note that this doesn't have anything to do with debugging - facilities or information available to PHP scripts.) + facilities or information available to PHP scripts.)</simpara> </sect3> <sect3 id="enable-safe-mode"> @@ -535,12 +509,11 @@ <simpara> Enables "safe mode" by default. This imposes several restrictions on what PHP can do, such as opening only files - within the document root. Read the <link - linkend="security">Security chapter</link> for more more + within the document root. Read the <link linkend="security">Security chapter</link> for more more information. CGI users should always enable secure mode. This option only sets the default, it may be enabled or disabled with the <link linkend="ini.safe-mode">safe_mode</link> directive in - the <link linkend="configuration.file">configuration file</link> later. + the <link linkend="configuration.file">configuration file</link> later.</simpara> </sect3> <sect3 id="enable-track-vars"> @@ -552,9 +525,8 @@ Makes PHP keep track of where GET/POST/cookie variables come from in the arrays HTTP_GET_VARS, HTTP_POST_VARS and HTTP_COOKIE_VARS. This option only sets the default, it may be - enabled or disabled with the <link - linkend="ini.track-vars">track_vars</link> directive in the - <link linkend="configuration.file">configuration file</link> later. + enabled or disabled with the <link linkend="ini.track-vars">track_vars</link> directive in the + <link linkend="configuration.file">configuration file</link> later.</simpara> </sect3> <sect3 id="enable-magic-quotes"> @@ -564,14 +536,11 @@ </synopsis> <simpara> Enable magic quotes by default. This option only sets the - default, it may be enabled or disabled with the <link - linkend="ini.magic-quotes-runtime">magic_quotes_runtime</link> + default, it may be enabled or disabled with the <link linkend="ini.magic-quotes-runtime">magic_quotes_runtime</link> directive in the <link linkend="configuration.file">configuration - file</link> later. See also the <link - linkend="ini.magic-quotes-gpc"> magic_quotes_gpc</link> and the - <link - linkend="ini.magic-quotes-sybase">magic_quotes_sybase</link> - directives. + file</link> later. See also the <link linkend="ini.magic-quotes-gpc"> magic_quotes_gpc</link> and the + <link linkend="ini.magic-quotes-sybase">magic_quotes_sybase</link> + directives.</simpara> </sect3> <sect3 id="enable-debugger"> @@ -581,10 +550,9 @@ </synopsis> <simpara> Enables the internal PHP debugger support. This feature is - still in an experimental state. See also the <link - linkend="ini.sect.debugger">Debugger Configuration</link> + still in an experimental state. See also the <link linkend="ini.sect.debugger">Debugger Configuration</link> directives in the <link linkend="configuration.file">configuration - file</link>. + file</link>.</simpara> </sect3> <sect3 id="enable-discard-path"> @@ -595,9 +563,8 @@ <simpara> If this is enabled, the PHP CGI binary can safely be placed outside of the web tree and people will not be able to - circumvent .htaccess security. Read the <link - linkend="security.cgi.shell">section in the security - chapter</link> about this option. + circumvent .htaccess security. Read the <link linkend="security.cgi.shell">section in the security + chapter</link> about this option.</simpara> </sect3> <sect3 id="enable-bcmath"> @@ -607,9 +574,8 @@ </synopsis> <simpara> Enables <command>bc</command> style arbitrary precision math - functions. See also the <link - linkend="ini.sect.bcmath">bcmath.scale </link> option in the - <link linkend="configuration.file">configuration file</link>. + functions. See also the <link linkend="ini.sect.bcmath">bcmath.scale </link> option in the + <link linkend="configuration.file">configuration file</link>.</simpara> </sect3> <sect3 id="enable-force-cgi-redirect"> @@ -619,30 +585,28 @@ </synopsis> <simpara> Enable the security check for internal server redirects. You - should use this if you are running the CGI version with Apache. + should use this if you are running the CGI version with Apache.</simpara> <simpara> When using PHP as a CGI binary, PHP by default always first checks that it is used by redirection (for example under Apache, by using Action directives). This makes sure that the PHP binary cannot be used to bypass standard web server - authentication procedures by calling it directly, like <filename - role=url>http://my.host/cgi-bin/php/secret/doc.html</filename>. - This example accesses <filename - role=url>http://my.host/secret/doc.html</filename> but does not + authentication procedures by calling it directly, like <filename role="url">http://my.host/cgi-bin/php/secret/doc.html</filename>. + This example accesses <filename role="url">http://my.host/secret/doc.html</filename> but does not honour any security settings enforced by httpd for directory - <filename role=dir>/secret</filename>. + <filename role="dir">/secret</filename>.</simpara> <simpara> Not enabling option disables the check and enables bypassing httpd security and authentication settings. Do this only if your server software is unable to indicate that a safe redirection was done and all your files under your document root and - user directories may be accessed by anyone. + user directories may be accessed by anyone.</simpara> <simpara> Read the <link linkend="security.cgi.force-redirect">section in - the security chapter</link> about this option. + the security chapter</link> about this option.</simpara> </sect3> <sect3 id="disable-short-tags"> @@ -658,7 +622,7 @@ only sets the default, it may be enabled or disabled with the <link linkend="ini.short-open-tag">short_open_tag</link> directive in the <link linkend="configuration.file">configuration - file</link> later. + file</link> later.</simpara> </sect3> <sect3 id="enable-url-includes"> @@ -668,10 +632,8 @@ </synopsis> <simpara> Makes it possible to run code on other HTTP or FTP servers - directly from PHP with <link - linkend="function.include">include()</link>. See also the <link - linkend="ini.include-path">include_path</link> option in the - <link linkend="configuration.file">configuration file</link>. + directly from PHP with <link linkend="function.include">include()</link>. See also the <link linkend="ini.include-path">include_path</link> option in the + <link linkend="configuration.file">configuration file</link>.</simpara> </sect3> <sect3 id="disable-syntax-hl"> @@ -680,7 +642,7 @@ <option>--disable-syntax-hl</option> </synopsis> <simpara> - Turns off syntax highlighting. + Turns off syntax highlighting.</simpara> </sect3> <sect3> @@ -692,7 +654,7 @@ you are using a sensible shell, you should be able to do <command> LDFLAGS=-L/my/lib/dir CPPFLAGS=-I/my/include/dir ./configure - </command> + </command></para> </sect3> </sect2> @@ -704,8 +666,7 @@ When PHP is configured, you are ready to build the CGI executable or the PHP library. The command <command>make</command> should take care of this. If it fails - and you can't figure out why, see the <link - linkend="install-problems">Problems section</link>. + and you can't figure out why, see the <link linkend="install-problems">Problems section</link>.</simpara> </sect2> @@ -716,7 +677,7 @@ by typing <command>make test</command>. It is always a good idea to test your build. This way you may catch a problem with PHP on your platform early instead of having to struggle with it - later. + later.</simpara> </sect2> <sect2> @@ -727,11 +688,9 @@ mode is on by default, the benchmark may not be able to finish if it takes longer then the 30 seconds allowed. This is because the <function>set_time_limit</function> can not be used in safe - mode. Use the <link - linkend="ini.max-execution-time">max_execution_time</link> + mode. Use the <link linkend="ini.max-execution-time">max_execution_time</link> configuration setting to control this time for your own - scripts. <command>make bench</command> ignores the <link - linkend="configuration.file">configuration file</link>. + scripts. <command>make bench</command> ignores the <link linkend="configuration.file">configuration file</link>.</simpara> </sect2> </sect1> @@ -742,8 +701,7 @@ <simpara> This install guide will help you install and configure PHP on your Windows 9x/NT webservers. This guide was compiled - by &link.bob;. The latest revision can be found at <ulink - url="&url.win32install">&url.win32install</ulink>. + by &link.bob;. The latest revision can be found at <ulink url="&url.win32install">&url.win32install</ulink>.</simpara> <para> This guide provides installation support for: @@ -759,7 +717,7 @@ </para></listitem> <listitem><para>Omni HTTPd 2.0b1 </para></listitem> - </itemizedlist> + </itemizedlist></para> <sect2> <title>General Installation Steps</title> @@ -810,8 +768,7 @@ starts. You can uncomment the: 'extension=php3_*.dll' lines to load these modules. Some modules require you to have additional libraries installed on your system for the - module to work correctly. The PHP <ulink - url="&url.php.faq">FAQ</ulink> has more information on + module to work correctly. The PHP <ulink url="&url.php.faq">FAQ</ulink> has more information on where to get supporting libraries. You can also load a module dynamically in your script using: <command>dl("php_*.dll");</command> @@ -823,19 +780,18 @@ 'c:\windows\system\inetsrv\browscap.ini' on Windows 95/98 and 'c:\winnt\system32\inetsrv\browscap.ini' on NT Server. Additional information on using the browscap - functionality in PHP can be found at this <ulink - url="&url.browscap;">mirror</ulink>, select the "source" + functionality in PHP can be found at this <ulink url="&url.browscap;">mirror</ulink>, select the "source" button to see it in action. </simpara> </listitem> </itemizedlist> </para> </listitem> - </itemizedlist> + </itemizedlist></para> <simpara> The DLLs for PHP extensions are prefixed with 'php3_'. This prevents - confusion between PHP extensions and their supporting libraries. + confusion between PHP extensions and their supporting libraries.</simpara> </sect2> @@ -972,12 +928,11 @@ Exit Regedit. </simpara> </listitem> - </itemizedlist> + </itemizedlist></para> <simpara> PWS and IIS 3 users now have a fully operational system. IIS 3 - users can use a nifty <ulink - url="http://www.genusa.com/iis/iiscfg.html">tool</ulink> from + users can use a nifty <ulink url="http://www.genusa.com/iis/iiscfg.html">tool</ulink> from Steven Genusa to configure their script maps. </simpara> @@ -1054,7 +1009,7 @@ Although there can be a few variations of configuring PHP under Apache, this one is simple enough to be used by the newcomer. Please consult the Apache Docs for further - configuration directives. + configuration directives.</simpara> <para> <itemizedlist> @@ -1126,7 +1081,7 @@ <member> Step 6: Click <literal>OK</literal> </member> - </simplelist> + </simplelist></para> <simpara> Repeat steps 2 - 6 for each extension you want to associate with @@ -1228,8 +1183,7 @@ <title>Read the FAQ</title> <simpara> Some problems are more common than others. The most common ones - are listed in the PHP FAQ, found at <ulink - url="&url.php.faq;">&url.php.faq;</ulink> + are listed in the PHP FAQ, found at <ulink url="&url.php.faq;">&url.php.faq;</ulink></simpara> </sect2> <sect2> @@ -1239,8 +1193,7 @@ If you think you have found a bug in PHP, please report it. The PHP developers probably don't know about it, and unless you report it, chances are it won't be fixed. You - can report bugs using the bug-tracking system at <ulink - url="&url.php.bugs;">&url.php.bugs;</ulink>. + can report bugs using the bug-tracking system at <ulink url="&url.php.bugs;">&url.php.bugs;</ulink>.</simpara> </sect2> <sect2> @@ -1252,9 +1205,8 @@ case someone already answered someone else who had the same problem as you. The archives are available from the support page on <ulink url="&url.php;">&url.php;</ulink>. To - subscribe to the PHP mailing list, send an empty mail to <ulink - url="mailto:&email.php3.subscribe;">&email.php3.subscribe;</ulink>. - The mailing list address is <literal>&email.php3;</literal>. + subscribe to the PHP mailing list, send an empty mail to <ulink url="mailto:&email.php3.subscribe;">&email.php3.subscribe;</ulink>. + The mailing list address is <literal>&email.php3;</literal>.</simpara> <simpara> If you want to get help on the mailing list, please try to be @@ -1262,7 +1214,7 @@ (which operating system, what PHP version, what web server, if you are running PHP as CGI or a server module, etc.), and preferably enough code to make others able to reproduce and test - your problem. + your problem.</simpara></sect2></sect1> </chapter> Index: phpdoc/chapters/security.sgml diff -u phpdoc/chapters/security.sgml:1.3 phpdoc/chapters/security.sgml:1.4 --- phpdoc/chapters/security.sgml:1.3 Thu Sep 2 11:19:57 1999 +++ phpdoc/chapters/security.sgml Wed Oct 20 18:46:55 1999 @@ -10,7 +10,7 @@ PHP is designed specifically to be a more secure language for writing CGI programs than Perl or C, and with correct selection of compile-time and runtime configuration options it gives you - exactly the combination of freedom and security you need. + exactly the combination of freedom and security you need.</simpara> <simpara> As there are many different ways of utilizing PHP, there are many @@ -19,7 +19,7 @@ purposes, but it also means there are combinations of these options and server configurations that result in an insecure setup. This chapter explains the different configuration option - combinations and the situations they can be safely used. + combinations and the situations they can be safely used.</simpara> <sect1 id="security.cgi"> <title>CGI binary</title> @@ -34,64 +34,55 @@ different kinds of CGI wrappers to create safe chroot and setuid environments for scripts. This setup usually involves installing executable PHP binary to the web server cgi-bin - directory. CERT advisory <ulink - url="http://www.cert.org/advisories/CA-96.11.interpreters_in_cgi_bin_dir.html">CA-96.11</ulink> + directory. CERT advisory <ulink url="http://www.cert.org/advisories/CA-96.11.interpreters_in_cgi_bin_dir.html">CA-96.11</ulink> recommends against placing any interpreters into cgi-bin. Even if the PHP binary can be used as a standalone interpreter, PHP - is designed to prevent the attacks this setup makes possible: + is designed to prevent the attacks this setup makes possible:</simpara> <itemizedlist> <listitem><simpara>Accessing system files: - <filename role=url>http://my.host/cgi-bin/php?/etc/passwd</filename> + <filename role="url">http://my.host/cgi-bin/php?/etc/passwd</filename></simpara> <simpara> The query information in a url after the question mark (?) is passed as command line arguments to the interpreter by the CGI interface. Usually interpreters open and execute the - file specified as the first argument on the command line. + file specified as the first argument on the command line.</simpara> <simpara> When invoked as a CGI binary, PHP refuses to interpret the command line arguments. </simpara></listitem> <listitem><simpara>Accessing any web document on server: - <filename - role=url>http://my.host/cgi-bin/php/secret/doc.html</filename> + <filename role="url">http://my.host/cgi-bin/php/secret/doc.html</filename></simpara> <simpara> The path information part of the url after the PHP binary - name, <filename role=uri>/secret/doc.html</filename> is + name, <filename role="uri">/secret/doc.html</filename> is conventionally used to specify the name of the file to be opened and interpreted by the <acronym>CGI</acronym> program. Usually some web server configuration directives (Apache: Action) are used to redirect requests to documents like - <filename - role=url>http://my.host/secret/script.php3</filename> to the + <filename role="url">http://my.host/secret/script.php3</filename> to the PHP interpreter. With this setup, the web server first checks - the access permissions to the directory <filename - role=uri>/secret</filename>, and after that creates the - redirected request <filename - role=url>http://my.host/cgi-bin/php/secret/script.php3</filename>. + the access permissions to the directory <filename role="uri">/secret</filename>, and after that creates the + redirected request <filename role="url">http://my.host/cgi-bin/php/secret/script.php3</filename>. Unfortunately, if the request is originally given in this form, no access checks are made by web server for file - <filename role=uri>/secret/script.php3</filename>, but only - for the <filename role=uri>/cgi-bin/php</filename> file. This - way any user able to access <filename - role=uri>/cgi-bin/php</filename> is able to access any - protected document on the web server. + <filename role="uri">/secret/script.php3</filename>, but only + for the <filename role="uri">/cgi-bin/php</filename> file. This + way any user able to access <filename role="uri">/cgi-bin/php</filename> is able to access any + protected document on the web server.</simpara> <simpara> - In PHP, compile-time configuration option <link - linkend="enable-force-cgi-redirect">--enable-force-cgi-redirect</link> - and runtime configuration directives <link - linkend="ini.doc-root">doc_root</link> and <link - linkend="ini.user-dir">user_dir</link> can be used to prevent + In PHP, compile-time configuration option <link linkend="enable-force-cgi-redirect">--enable-force-cgi-redirect</link> + and runtime configuration directives <link linkend="ini.doc-root">doc_root</link> and <link linkend="ini.user-dir">user_dir</link> can be used to prevent this attack, if the server document tree has any directories with access restrictions. See below for full the explanation of the different combinations. </simpara></listitem> - </itemizedlist> + </itemizedlist></sect2> <sect2 id="security.cgi.default"> <title>Case 1: only public files served</title> @@ -101,30 +92,26 @@ these configuration options. If your web server does not allow you to do redirects, or the server does not have a way to communicate to the PHP binary that the request is a safely - redirected request, you can specify the option <link - linkend="enable-force-cgi-redirect">--disable-force-cgi-redirect</link> + redirected request, you can specify the option <link linkend="enable-force-cgi-redirect">--disable-force-cgi-redirect</link> to the configure script. You still have to make sure your PHP scripts do not rely on one or another way of calling the script, - neither by directly <filename - role=php>http://my.host/cgi-bin/php/dir/script.php3</filename> - nor by redirection <filename - role=php>http://my.host/dir/script.php3</filename>. + neither by directly <filename role="php">http://my.host/cgi-bin/php/dir/script.php3</filename> + nor by redirection <filename role="php">http://my.host/dir/script.php3</filename>.</simpara> <simpara> Redirection can be configured in Apache by - using AddHandler and Action directives (see below). + using AddHandler and Action directives (see below).</simpara></sect2> <sect2 id="security.cgi.force-redirect"> <title>Case 2: using --enable-force-cgi-redirect</title> <simpara> This compile-time option prevents anyone from calling PHP - directly with a url like <filename - role=php>http://my.host/cgi-bin/php/secretdir/script.php3</filename>. + directly with a url like <filename role="php">http://my.host/cgi-bin/php/secretdir/script.php3</filename>. Instead, PHP will only parse in this mode if it has gone through - a web server redirect rule. + a web server redirect rule.</simpara> <simpara> Usually the redirection in the Apache configuration is done with - the following directives: + the following directives:</simpara> <programlisting role="apache-conf"> Action php3-script /cgi-bin/php AddHandler php3-script .php3 @@ -137,7 +124,7 @@ If your web server does not support any way of telling if the request is direct or redirected, you cannot use this option and you must use one of the other ways of running the CGI version - documented here. + documented here.</simpara></sect2> <sect2 id="security.cgi.doc-root"> <title>Case 3: setting doc_root or user_dir</title> @@ -150,57 +137,50 @@ information like passwords. Therefore many sysadmins will prefer setting up another directory structure for scripts that are accessible only through the PHP CGI, and therefore always - interpreted and not displayed as such. + interpreted and not displayed as such.</simpara> <simpara> Also if the method for making sure the requests are not redirected, as described in the previous section, is not available, it is necessary to set up a script doc_root that is - different from web document root. + different from web document root.</simpara> <simpara> You can set the PHP script document root by the configuration - directive <link linkend="ini.doc-root">doc_root</link> in the <link - linkend="configuration.file">configuration file</link>, or you + directive <link linkend="ini.doc-root">doc_root</link> in the <link linkend="configuration.file">configuration file</link>, or you can set the environment variable <envar>PHP_DOCUMENT_ROOT</envar>. If it is set, the CGI version of PHP will always construct the file name to open with this <parameter>doc_root</parameter> and the path information in the request, so you can be sure no script is executed outside this directory (except for <parameter>user_dir</parameter> - below). + below).</simpara> <simpara> - Another option usable here is <link - linkend="ini.user-dir">user_dir</link>. When user_dir is unset, + Another option usable here is <link linkend="ini.user-dir">user_dir</link>. When user_dir is unset, only thing controlling the opened file name is - <parameter>doc_root</parameter>. Opening an url like <filename - role=url>http://my.host/~user/doc.php3</filename> does not + <parameter>doc_root</parameter>. Opening an url like <filename role="url">http://my.host/~user/doc.php3</filename> does not result in opening a file under users home directory, but a file - called <filename role=uri>~user/doc.php3</filename> under + called <filename role="uri">~user/doc.php3</filename> under doc_root (yes, a directory name starting with a tilde - [<literal>~</literal>]). + [<literal>~</literal>]).</simpara> <simpara> - If user_dir is set to for example <filename - role=dir>public_php</filename>, a request like <filename - role=url>http://my.host/~user/doc.php3</filename> will open a + If user_dir is set to for example <filename role="dir">public_php</filename>, a request like <filename role="url">http://my.host/~user/doc.php3</filename> will open a file called <filename>doc.php3</filename> under the directory - named <filename role=dir>public_php</filename> under the home - directory of the user. If the home of the user is <filename - role=dir>/home/user</filename>, the file executed is - <filename>/home/user/public_php/doc.php3</filename>. + named <filename role="dir">public_php</filename> under the home + directory of the user. If the home of the user is <filename role="dir">/home/user</filename>, the file executed is + <filename>/home/user/public_php/doc.php3</filename>.</simpara> <simpara> <parameter>user_dir</parameter> expansion happens regardless of the <parameter>doc_root</parameter> setting, so you can control - the document root and user directory access separately. + the document root and user directory access separately.</simpara></sect2> <sect2 id="security.cgi.shell"> <title>Case 4: PHP parser outside of web tree</title> <para> A very secure option is to put the PHP parser binary somewhere - outside of the web tree of files. In <filename - role=dir>/usr/local/bin</filename>, for example. The only real + outside of the web tree of files. In <filename role="dir">/usr/local/bin</filename>, for example. The only real downside to this option is that you will now have to put a line similar to: @@ -215,19 +195,18 @@ exactly as you would treat any other CGI script written in Perl or sh or any other common scripting language which uses the <literal>#!</literal> shell-escape mechanism for launching - itself. + itself.</para> <para> To get PHP to handle <envar>PATH_INFO</envar> and <envar>PATH_TRANSLATED</envar> information correctly with this - setup, the php parser should be compiled with the <link - linkend="enable-discard-path">--enable-discard-path</link> - configure option. + setup, the php parser should be compiled with the <link linkend="enable-discard-path">--enable-discard-path</link> + configure option.</para></sect2></sect1> <sect1 id="security.apache"> <title>Apache module</title> <simpara> When PHP is used as an Apache module it inherits Apache's user - permissions (typically those of the "nobody" user). + permissions (typically those of the "nobody" user).</simpara></sect1> </chapter>