PHP 4.0 Bug #6815 Updated: php.ini-optimized disables passing of apache vars

ID: 6815 Updated by: jmoore Reported By: johnford@speakeasy.org Status: Assigned Bug Type: Documentation problem Assigned To: Comments: The reason for this is to try to encourage to stop people using register_globals and to try and discourage people from relying on them so much as this can cause scripts to be insecure. Most of the time this is not an issue but if you are interested see the recent posts about php on bugtrak. I will look into adding a note to the install file. There is also a rather large note about whats changed at the top of php.ini-optimized about whats different. James Previous Comments: --------------------------------------------------------------------------- [2000-09-20 11:26:19] johnford@speakeasy.org First of all, let me say, this IS a configuration problem, and copious reading of the documentation will sort this out for anyone willing to take the time. BUT, some people, as I would have, would rather compile, install, and go. The problem I came across is that when I upgraded to PHP4, I copied php.ini-optimized to /usr/local/lib/php.ini (Hell, who doesn't want something "optimized"). Then I started running into all sorts of problems with my existing scripts. Logins we failing, counters were not incrementing correctly, and various other stuff. I finaly noticed that all of my scripts that were having problems used global variables like "$PHP_AUTH_USER" and "$PHP_SELF", and then I did some debugging to find that these variables were empty. FInally, I figured out that the supplied php.ini-optimized diabled global-variables, even though I had enabled them at compile-time. Basically, I think this is bad. Since everyone, of course, is going to want their installation to be "optimized" a lot of people are going to install this version of php.ini, instead of the supplied php.ini-dist. (Yes, I realize the INSTALL file says to copy php.ini-dist, but no mention is made that php.ini-optimized might break things.) RTFM notwithstanding, I think it would benefit all involved if php.ini-optimized were renamed to something not so enticing and so noted in the docs. That's my lame bug-report. --------------------------------------------------------------------------- Full Bug description available at: http://bugs.php.net/?id=6815