Re: installing HTTP_Request

Bennett Haselton wrote: > At 10:58 PM 12/5/2007 -0600, Gregory Beaver wrote: >> Bennett Haselton wrote: >> > At 06:26 PM 12/5/2007 -0600, Gregory Beaver wrote: >> >> You are also using a very old version of PHP, one that has many known >> >> security vulnerabilities, that may be of greater concern than the >> >> upgrading of PEAR, were I in your shoes. >> >> >> >> As for making it possible to upgrade from 1.3.2, it is possible, >> but the >> >> problem is that 1.3.2 has so many serious bugs in it, it is not >> capable >> >> of doing an upgrade properly, and will leave your system corrupted. >> >> This is not something that can be fixed, except by upgrading. >> > >> > Well all I know is that 4 freshly set up dedicated servers all had PEAR >> > 1.3.2 installed on them by default, so I figured that meant it was >> quite >> > common out there. Although I don't know, since it sounds like you >> don't >> > get this question often! >> >> You might want to alert the sysadmins that they are opening their >> machine to serious security vulnerabilities with these ancient php/pear >> versions, and the fix is ridiculously simple. > > I'd say that if 4 out of 4 dedicated hosting providers are doing > something wrong, probably most of the rest of them are too, and it's a > losing battle to try and set them straight one at a time. The problem > seems to be that this "ancient, insecure" version of PEAR is included > with CentOS 4.x by default, so I'd try to persuade the CentOS people to > fix that. I have no idea if they'd even make changes to 4.x after 5.x > is out, I'm sure most people on this list know better than me how that > works. Thanks Bennett, this would be very helpful. Most distros are distributing newer PEAR versions, it would be really great to have all of them doing so for the sake of people like you who wouldn't need to waste time asking on pear-general how to fix it. :) Greg