Debian Bug report logs - #399258
php5: Turn off allow_url_fopen by default

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: David Garamond <david_garamond@yahoo.com>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: php5: Turn off allow_url_fopen by default

Date: Sun, 19 Nov 2006 03:58:15 +0700

Package: php5
Version: 5.1.6-4+spanel1
Severity: wishlist
Tags: patch


Allow_url_fopen is nowadays by far the prominent cause of web exploits
(remote file vulnerability in PHP web applications). As an active
security measure, I suggest we disable this option by default in PHP,
not just php.ini, because in some systems a hosting user is allowed to
have their own php.ini which might be old/not updated. The PHP team is
also considering turning this option off by default.

START PATCH

diff -ru php-4.4.4.orig/main/main.c php-4.4.4/main/main.c
--- php-4.4.4.orig/main/main.c  2006-05-19 05:36:14.000000000 +0700
+++ php-4.4.4/main/main.c       2006-11-19 01:52:01.000000000 +0700
@@ -352,7 +352,7 @@
        PHP_INI_ENTRY("disable_functions",                      "",                     PHP_INI_SYSTEM,         NULL)
        PHP_INI_ENTRY("disable_classes",                        "",                     PHP_INI_SYSTEM,         NULL)

-       STD_PHP_INI_BOOLEAN("allow_url_fopen",          "1",            PHP_INI_SYSTEM,         OnUpdateBool,                   allow_url_fopen,                        php_core_globals,       core_globals)
+       STD_PHP_INI_BOOLEAN("allow_url_fopen",          "0",            PHP_INI_SYSTEM,         OnUpdateBool,                   allow_url_fopen,                        php_core_globals,       core_globals)
        STD_PHP_INI_BOOLEAN("always_populate_raw_post_data",            "0",            PHP_INI_SYSTEM|PHP_INI_PERDIR,          OnUpdateBool,                   always_populate_raw_post_data,    php_core_globals,        core_globals)

 PHP_INI_END()
Only in php-4.4.4/main: main.c~

END PATCH

-- System Information:
Debian Release: testing/unstable
  APT prefers testing
  APT policy: (600, 'testing'), (550, 'stable'), (50, 'unstable'), (40, 'experimental')
Architecture: i386 (i686)
Shell:  /bin/sh linked to /bin/bash
Kernel: Linux 2.6.15-1-k7
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)

Versions of packages php5 depends on:
ii  php5-cgi                 5.1.6-4+spanel1 server-side, HTML-embedded scripti
ii  php5-common              5.1.6-4+spanel1 Common files for packages built fr

php5 recommends no packages.

-- no debconf information

Message #10 received at 399258@bugs.debian.org (full text, mbox, reply):

From: Steve Langasek <vorlon@debian.org>

To: David Garamond <david_garamond@yahoo.com>, 399258@bugs.debian.org, 399259@bugs.debian.org

Subject: Re: [php-maint] Bug#399258: php5: Turn off allow_url_fopen by default

Date: Sat, 18 Nov 2006 16:05:30 -0800

On Sun, Nov 19, 2006 at 03:58:15AM +0700, David Garamond wrote:

> Allow_url_fopen is nowadays by far the prominent cause of web exploits
> (remote file vulnerability in PHP web applications).

The most prominent cause of web exploits is that idiots are allowed to write
web applications.  Everything else is damage control.

> As an active security measure, I suggest we disable this option by default
> in PHP, not just php.ini, because in some systems a hosting user is
> allowed to have their own php.ini which might be old/not updated. The PHP
> team is also considering turning this option off by default.

I don't think Debian needs to second-guess the PHP Team in this case.

-- 
Steve Langasek                   Give me a lever long enough and a Free OS
Debian Developer                   to set it on, and I can move the world.
vorlon@debian.org                                   http://www.debian.org/

Message #17 received at 399258@bugs.debian.org (full text, mbox, reply):

From: "Thijs Kinkhorst" <thijs@debian.org>

To: 399258@bugs.debian.org

Cc: "David Garamond" <david_garamond@yahoo.com>

Subject: Re: [php-maint] Bug#399258: php5: Turn off allow_url_fopen by default

Date: Thu, 20 Nov 2008 15:02:48 +0100 (CET)

> Allow_url_fopen is nowadays by far the prominent cause of web exploits
> (remote file vulnerability in PHP web applications).

That knowledge used to be true when we had PHP4, but I believe its risks
are a lot smaller with PHP5, where this setting does not apply to
include() and require() calls. Those calls were the most prominent cause
of exploits.

> As an active
> security measure, I suggest we disable this option by default in PHP,
> not just php.ini,

Turning it off by default, hardcoding it is really not Debian's job here,
the choice is left to the administrator on how to handle that.


cheers,
Thijs

Message #24 received at 399258-done@bugs.debian.org (full text, mbox, reply):

From: Thijs Kinkhorst <thijs@debian.org>

To: 399258-done@bugs.debian.org

Subject: less relevant with php5

Date: Tue, 14 Jul 2009 23:54:55 +0200

[Message part 1 (text/plain, inline)]

Hi,

I'm closing this bug as per my statement on 20 Nov 2008: because the 
allow_url_fopen doesn't apply to include and require anymore in PHP5, the 
major exploitation vector has disappeared and this isn't a priority anymore. 
We should therefore follow upstream in this.


Thijs

[signature.asc (application/pgp-signature, inline)]

Send a report that this bug log contains spam.