phpBB 3.x.x and register_global ...

[alcaeus]

We are still looking at what to do with respects to this code.

Well, glad you're rethinking it. I think the problem is simple: not everybody can disable register_globals, some hosters have it enabled and refuse to disable it. For those people, I wouldn't disable the installation globally.

I'd like to just open up discussion here (hope you don't mind). How about simply putting a big, red, bold warning on top, saying that register_globals should be disabled. In addition to that, add a link to an information page, which tells why register_globals is bad, and how it can be disabled. IMO, that would be more helpful than the red text saying "Failed" and that phpBB cannot be installed.

Greetz
alcaeus

[MartinTruckenbrodt]

Hello
with "php_flag register_globals on" I'm getting error 500 too.

I found a workaround:
// for the lines 549, 550 and 554

But I'm getting an error after the second step:
Notice: Undefined variable: sql_db in .../install/install.php on line 1059

Fatal error: Cannot instantiate non-existent class: in .../install/install.php on line 1059

Bye Martin

[Lastof]

That's a common error. It's simple to fix by adding a single line of code.

However, we're not allowed to offer support.

[Lieutenant Clone]

I can see two comprimises for the situation. One would be to turn off register_globals in the .htaccess file in the phpbb root. Someone noted that gave them an error, but still, this is more likely to work than trying to get your hosting company to turn it off all together(and they would even be more likely to change the configuration so you can turn them off through the .htacess if that is the confilict).

The second comprimise would be to allow install of the script with register_globals on, and flag their board as having it on) but deny those users support(untill they turn it off).

my $0.02

[MHobbit]

I can see two comprimises for the situation. One would be to turn off register_globals in the .htaccess file in the phpbb root. Someone noted that gave them an error, but still, this is more likely to work than trying to get your hosting company to turn it off all together(and they would even be more likely to change the configuration so you can turn them off through the .htacess if that is the confilict).

The second comprimise would be to allow install of the script with register_globals on, and flag their board as having it on) but deny those users support(untill they turn it off).

my $0.02

.htaccess is only for Apache servers. I doubt even something as trivial as that would be added to the official ZIP if it doesn't work for different servers.

register_globals is to go the way of the Do Do (in PHP6 thank goodness). Let it go.

I will still note that we still don't support development versions such as the one obtainable via CVS.

[aaaaaaa]

Or.. do what i did and delete the check outta the install.php

[spencerp]

Just out of curiosity, how is this supposed to look in the roots/ .htaccess file... this is what I have now:

Code: Select all

<Files "config.php">
Order Allow,Deny
Deny from All
</Files>


<Files "common.php">
Order Allow,Deny
Deny from All
</Files>

My host said to add this line in it:

Code: Select all

php_value register_globals 1

So how is the end result of it supposed to be lol!? I'm not the greatest for messing with the .htaccess file, but just copying and pasting that above code into the .htaccess file, didn't do anything...

They also said if I do that and get a 500 Internal server error, to then let them know.. I'm not getting anything.. prolly because I'm not doing something right I dunno.. Anyways, I also tried removing some call tags from the install.php for the register_globals....and was able to get to the next step, but it spit out some errors in the top of the page..

I kept going, had some more problems...reuploaded a good copy of the install.php file...then went through some more, had problems lmao!! I then even got to the point of downloading the config.php, uploaded it, hit done or whatever, it said no databases were there, I went into the phpMyAdmin, imported the mysqlschema file and had the tables added...

Deleted the install/ directory...went to the /forum/ location, and got a basic blank page with a message at top about "removing" or "not removing" the common.php file, you will then lose support...

I'm not sure now, but I have it all back to the way it was to start with lol! Dropped the tables in the database, uploaded a new install/ directory again with fresh copies..and a blank config.php.....Sooo.. I'm back to this php call tag for the globals in the .htaccess file now.. Please read the initial first couple of paragraphs.. Thanks in advance...

spencerp

[code reader]

My host said to add this line in it:

Code: Select all

php_value register_globals 1

So how is the end result of it supposed to be lol!? I'm not the greatest for messing with the .htaccess file, but just copying and pasting that above code into the .htaccess file, didn't do anything...

maybe because the line above turns register_globals ON.
to turn it off change the 1 to 0.
also, according to php documentation, for register_globals you are supposed to use php_flag. it is entirely possible that php_value should also work, but fwiw, the php doc show this line:

Code: Select all

php_flag register_globals off

as to the question "where in the .htaccess file should i add it?"
A. add it as the first line, outside of any <Directive>....</Directive> block.

[spencerp]

My host said to add this line in it:

Code: Select all

php_value register_globals 1

So how is the end result of it supposed to be lol!? I'm not the greatest for messing with the .htaccess file, but just copying and pasting that above code into the .htaccess file, didn't do anything...

maybe because the line above turns register_globals ON.
to turn it off change the 1 to 0.
also, according to php documentation, for register_globals you are supposed to use php_flag. it is entirely possible that php_value should also work, but fwiw, the php doc show this line:

Code: Select all

php_flag register_globals off

as to the question "where in the .htaccess file should i add it?"
A. add it as the first line, outside of any <Directive>....</Directive> block.

Hahaha, flucking hell yeah!! Thanks so much man... Yeah I wasn't sure about that code my host told me to do because I'm just not familiar with that stuff... But this did work on the first attempt..

Code: Select all

php_flag register_globals off

Thanks a million man..

spencerp

[alcaeus]

The second comprimise would be to allow install of the script with register_globals on, and flag their board as having it on) but deny those users support(untill they turn it off).

Oh boy, you don't have any idea of what it means to support dumb users, do you? Just imagine these scenarios:
Sc. 1: 14yr old kid wants forum, finds phpBB. Downloads it, writes his "PHPbb rul0rZ" post somewhere. Gets some free php webspace, uploads phpBB, tries to install it, doesn't work because of register_globals. Let's just say it: he's f***ed
Sc. 2: 14yr old kid wants forum, finds phpBB. Downloads it, writes his "PHPbb rul0rZ" post somewhere. Gets some free php webspace, uploads phpBB, tries to install it, and it gives him a warning about register_globals. He ignores it, works on the board. Then he realizes some "bug" because he forgot to change some permission for a folder. Goes to phpbb.com, asks for support, and is told to help himself because register_globals is on, and he has no chance of turning it off.

Isn't life sweet?

Bottom line: not everything that makes sense to an advanced user makes sense to the average Joe

And that's my $0.02

Greetz
alcaeus