Blocked by security issues of running PHP as a CGI
| From: | Paul Trimming | Date: | Fri, 08 Nov 2002 23:42:00 +0000 |
| Subject: | Blocked by security issues of running PHP as a CGI | ||
| Groups: | php.windows | ||
| Request: | Send a blank email to php-windows+get-16830@lists.php.net to get a copy of this message | ||
Hello,
I am endeavouring to set up PHP with Xitami web server, which I am able to
run perfectly successfully by itself. However, when I try to run a PHP
executable, I get the following error in the browser:
Security Alert! The PHP CGI cannot be accessed directly.
This PHP CGI binary was compiled with force-cgi-redirect enabled. This means
that a page will only be served up if the REDIRECT_STATUS CGI variable is
set, e.g. via an Apache Action directive.
I have taken a look at the php.ini file in the relevant section, and I have
the following:
; cgi.force_redirect is necessary to provide security running PHP as a CGI
under
; most web servers. Left undefined, PHP turns this on by default. You can
; turn it off here AT YOUR OWN RISK
; **You CAN safely turn this off for IIS, in fact, you MUST.**
cgi.force_redirect=0
; if cgi.force_redirect is turned on, and you are not running under Apache
or Netscape
; (iPlanet) web servers, you MAY need to set an environment variable name
that PHP
; will look for to know it is OK to continue execution. Setting this
variable MAY
; cause security issues, KNOW WHAT YOU ARE DOING FIRST.
cgi.redirect_status_env=1
I have tried various combinations of force_redirect and redirect_status_env,
but I still get the error. According to the manual, at
http://www.php.net/manual/en/security.cgi-bin.php,
it is possible to use the
above variables to sort the matter out.
I would appreciate some explanation of this so that I can begin learning
PGP!!!!
Thanks very much,
Paul Trimming