Tag Info

Hot answers tagged

12

Which PHP binary are you using? The CLI or CGI? I suspect you need a CGI version of the binary for PHP to properly handle accept the environment variables and POST data if you pass that. The php-cgi binary implements the CGI interface, which allows you to pass parameters on the command line: php-cgi -f index.php left=1058 right=1067 class=A ...


11

You appear to be having this issue, which is because at some point nvi started opening files O_RDWR instead of O_RDONLY. If your vi is in fact nvi, I'd try using a different vi, say vim.


8

It looks like it goes through and makes an HTML table out of all of your environmental variables. Would you consider that nefarious? I'd consider anything that I didn't put on my own server to be nefarious, but that's me.


6

Running PHP as a module is usually more efficient, but means all scripts run under the same user account (what-ever account Apache runs as) which can pose security concerns in a shared environment. CGI is much slower as it starts a new PHP processes for every request that needs one, but can be configured to run each script as the user that owns it which can ...


5

Generally speaking, the only reason you would want to run CGI is in a shared environment. This allows you to have an suEXEC style (see: suPHP) arrangement where scripts are only executed as the owner's UID/GID and have limited permission to anything else on the filesystem. Otherwise mod_php is far more efficient and often easier to debug.


5

The username will be available in the environment variable REMOTE_USER. This works for nearly every authentication method, should you ever start using digest or maybe even kerberos authentication.


5

This is addressed here. Sadly, it seems to be difficult or impossible, given the constraints on the TFTP protocol. > Hi. > > Has there ever been any consideration to allowing the tftp server to > provide dynamic content? > Yes. The protocol makes it difficult. You pretty much have to guarantee that the contents is ...


4

This answer suggests an Apache solution: <Location "/backend/XXX.php"> SetEnvIf Content-Type ^(multipart/form-data)(.*) NEW_CONTENT_TYPE=multipart/form-data-alternate$2 OLD_CONTENT_TYPE=$1$2 RequestHeader set Content-Type %{NEW_CONTENT_TYPE}e env=NEW_CONTENT_TYPE </Location>


4

In general, simpler means faster. However, you will not be sure that server x is faster than server y unless you try it yourself. You can also look at the already done benchmarks (if any) to have an idea about it. The advanced web server can be slower than a simple/basic server because of the added complexity. However, the advanced server can be better in ...


4

"Simple" and "Fast" aren't always related, especially in computing -- in this case, SimpleHTTPServer uses the simple file reading methods, the simple networking methods, clean and obvious processing that's easy for a new programmer to read, etc; nginx has a ton of complicated code to make use of the advanced high-speed file & network APIs in the most ...


4

Looking at the code, it appears to be decidedly naive (it would be possible to use it to leverage an attack) however it doesn't appear to have been written for that purpose. However if the code is on your website and you don't know why / how it got there nor what function it serves, then you shouldn't even have to ask us before removing it!


4

Use the DirectoryIndex directive: DirectoryIndex index.php Here's more info on how to use DirectoryIndex.


4

One solution might be to write a wrapper script for the relevant commands, heavily secure this script and allow a passwordless sudo for this. Edit: A wrapper script is just some short shell script where you offload the critical commands. You can secure this (e.g. make it aceessible only be the Apache user). For sudo, there are many questions already on ...


4

Apache uses POST and GET to transfer data. It is probably POSTED to apache, which then sends it to the executable which could be C++, PHP, PERL, or any other number of programming languages. Your question should be "uploading via Apache" - Apache does not contain any files, the filesystem does. The apache module for cgi is called, surprisingly, mod_cgi.


4

I realise I'm very late to the party on this, but I think PHP FPM (FastCGI Process Manager) is the replacement. You need to use PHP 5.3.3 and use the --enable-fpm configure flag, or use the patch at the php-fpm website for earlier versions. An executable called php-fpm gets created in sapi/fpm.


4

Use the Status HTTP header. An example in Perl: #!/usr/bin/perl use strict; use warnings; print "Status: 404 Not Found\r\n"; print "Content-Type: text/html\r\n\r\n"; print "<h1>404 File not found!</h1>"; When using Perl (and other languages) however, excellent modules like CGI and CGI::Simple exist.


4

When PHP is used as a module, it's more-or-less compiled into Apache's code itself. It's loaded for every request which means that it's loaded even for images, scripts, stylesheets and any other files that aren't PHP. It makes serving those pages slower. On the other hand, it makes PHP faster since Apache doesn't have to spawn additional processes. When PHP ...


3

Try using the SetEnvIf directive, coupled with env in your Header directive: SetEnvIf Request_URI "/MyCGI" is_cgi Header set X-Frame-Options some-value env=!is_cgi (or something close to that :-))


3

Try to put in a .htaccess file in the mysite directory : RedirectMatch ^/$ http://mysubdomain.freehostia.com/cgi-bin/cgiscript.cgi RedirectMatch ^/data/ http://mysubdomain.freehostia.com/cgi-bin/cgiscript.cgi RedirectMatch ^/pybloxsom-installation/ http://mysubdomain.freehostia.com/cgi-bin/cgiscript.cgi it might not work if your hosting provider doesn't ...


3

We have a Delphi 5 CGI application that experienced the same issue on IIS 7. Our solution was similar to the one Steven posted above, however, we don't completely comment out the line marius mentions above. When I did, I saw that any Request.ContentString statement would bring back an empty string in the application. Our solution was to implement the code ...


3

Start on the webserver where the request is being processed. It could be dwarfs with punchcards shouting over tin can's connected by strings for all anyone here knows. Look at the webserver, and start tracing the request.


3

Running PHP via FastCGI will certainly give you the most flexibility. Not only can you safely use an mpm-worker Apache, you can even use another webserver altogether (e.g. nginx). But even when staying with Apache, "PHP via FastCGI" is at the moment not one option, but at least two: mod_fastcgi, mod_fcgid. On top of that, you can either use dynamic, static, ...


3

Whether a Perl CGI program gets invoked or not depends primarily on the server configuration and the "path" part of the resource path. The Perl CGI script might return HTML (and usually this is the case). So requesting a script is often effectively requesting an html page, even if the URL doesn't contain ".html". If the URL is, say, ...


3

You are going to have to pick one. Install the cli/cgi binary or use wget/curl to make a request to your web server. If you want to protect the script you could adjust the configuration of the web server to block access except from local host, or add something to the script to return an error if the request didn't originate from the local host. Of course ...


3

I don't believe there is any way to add a pool without restarting/reloading (as per this). I do think that redundancy is the best approach to this, I do believe, that you might accomplish what you want with reload. Since it is a graceful reload it should wait for the processes to finish. Essentially, pass the SIGUSR2 signal to php-fpm, and it will ...


3

The IMHO easiest (and quite secure) way is an indirect one: Make the webpage create a file somewhere if the user clicks the button and modify your script to only run if the file exists and delete it afterwards. Then run this script from a cron job every minute. You can even use this file to supply arguments to the script (which of course needs special ...


3

Another answer, since this is an entirely different (and much more generic) approach. One could argue that this is the canonical way to do such things :) Put your apache user (however it is named, I assume www-data) into the sudoers file (with visudo) with a very specific line that allows him to only run yourscript.py and only from the local machine ...


3

If you use Apache and have no access to it's configuration you can place .htaccess file inside web site folder. Just put following content in file .htaccess: DirectoryIndex index.php


3

You're defining the document root under the / location, and this doesn't apply to the \.php$ location. Move the root directive outside the / location so that it is applied to both. root /var/html; location / { index index.html index.htm; } location ~ \.php$ { ... }



Only top voted, non community-wiki answers of a minimum length are eligible