phpBB 3.x.x and register_global ...

Discussion of general topics related to the new version and its place in the world. Don't discuss new features, report bugs, ask for support, et cetera. Don't use this to spam for other boards or attack those boards!
Forum rules
Discussion of general topics related to the new release and its place in the world. Don't discuss new features, report bugs, ask for support, et cetera. Don't use this to spam for other boards or attack those boards!
alcaeus
Registered User
Posts: 66
Joined: Sun Oct 10, 2004 3:21 am
Location: Munich (Germany)
Contact:

Re: phpBB 3.x.x and register_global ...

Post by alcaeus »

Graham wrote: We are still looking at what to do with respects to this code.
Well, glad you're rethinking it. I think the problem is simple: not everybody can disable register_globals, some hosters have it enabled and refuse to disable it. For those people, I wouldn't disable the installation globally.

I'd like to just open up discussion here (hope you don't mind). How about simply putting a big, red, bold warning on top, saying that register_globals should be disabled. In addition to that, add a link to an information page, which tells why register_globals is bad, and how it can be disabled. IMO, that would be more helpful than the red text saying "Failed" and that phpBB cannot be installed.

Greetz
alcaeus
MartinTruckenbrodt
Posts: 171
Joined: Sun Jan 29, 2006 1:00 pm
Location: Germany
Contact:

Re: phpBB 3.x.x and register_global ...

Post by MartinTruckenbrodt »

Hello
with "php_flag register_globals on" I'm getting error 500 too.

I found a workaround:
// for the lines 549, 550 and 554

But I'm getting an error after the second step:
Notice: Undefined variable: sql_db in .../install/install.php on line 1059

Fatal error: Cannot instantiate non-existent class: in .../install/install.php on line 1059

Bye Martin
Advanced Block MOD 1.1.1 has been released! - Prevent spam on your phpBB3 board with Stop Forum Spam, BotScout, Akismet, Project Honey Pot and several IP-RBL and Domain-RBL DNS blacklists! - My MODs
User avatar
Lastof
Registered User
Posts: 518
Joined: Wed Mar 17, 2004 8:10 pm
Location: Two weeks last wednesday
Contact:

Re: phpBB 3.x.x and register_global ...

Post by Lastof »

That's a common error. It's simple to fix by adding a single line of code.

However, we're not allowed to offer support.
Last edited by Lastof on 04 May 2008, 00:00, edited -1 times in total
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Look, I'm officially not a bug!!
SHS`: "Oooh Bertie, spank me with that casing stick, spank me spank me spaaaaannnnk mee!"
Image
Lieutenant Clone
Registered User
Posts: 161
Joined: Tue Feb 28, 2006 6:13 pm

Re: phpBB 3.x.x and register_global ...

Post by Lieutenant Clone »

I can see two comprimises for the situation. One would be to turn off register_globals in the .htaccess file in the phpbb root. Someone noted that gave them an error, but still, this is more likely to work than trying to get your hosting company to turn it off all together(and they would even be more likely to change the configuration so you can turn them off through the .htacess if that is the confilict).

The second comprimise would be to allow install of the script with register_globals on, and flag their board as having it on) but deny those users support(untill they turn it off).

my $0.02
Dennis Robinson
Image
User avatar
MHobbit
Registered User
Posts: 198
Joined: Tue Mar 23, 2004 9:31 pm
Location: On the road to nowhere...
Contact:

Re: phpBB 3.x.x and register_global ...

Post by MHobbit »

Lieutenant Clone wrote: I can see two comprimises for the situation. One would be to turn off register_globals in the .htaccess file in the phpbb root. Someone noted that gave them an error, but still, this is more likely to work than trying to get your hosting company to turn it off all together(and they would even be more likely to change the configuration so you can turn them off through the .htacess if that is the confilict).

The second comprimise would be to allow install of the script with register_globals on, and flag their board as having it on) but deny those users support(untill they turn it off).

my $0.02
.htaccess is only for Apache servers. I doubt even something as trivial as that would be added to the official ZIP if it doesn't work for different servers.

register_globals is to go the way of the Do Do (in PHP6 thank goodness). Let it go. :-P

I will still note that we still don't support development versions such as the one obtainable via CVS.
Former phpBB MOD Team Member - No support offered via IM, PM, or email
aaaaaaa
Registered User
Posts: 9
Joined: Mon Feb 21, 2005 6:17 pm

Re: phpBB 3.x.x and register_global ...

Post by aaaaaaa »

Or.. do what i did and delete the check outta the install.php
spencerp
Registered User
Posts: 6
Joined: Mon Feb 27, 2006 10:20 am
Contact:

Re: phpBB 3.x.x and register_global ...

Post by spencerp »

Just out of curiosity, how is this supposed to look in the roots/ .htaccess file... this is what I have now:

Code: Select all

<Files "config.php">
Order Allow,Deny
Deny from All
</Files>


<Files "common.php">
Order Allow,Deny
Deny from All
</Files>
My host said to add this line in it:

Code: Select all

php_value register_globals 1
So how is the end result of it supposed to be lol!? I'm not the greatest for messing with the .htaccess file, but just copying and pasting that above code into the .htaccess file, didn't do anything...

They also said if I do that and get a 500 Internal server error, to then let them know.. I'm not getting anything.. prolly because I'm not doing something right I dunno.. Anyways, I also tried removing some call tags from the install.php for the register_globals....and was able to get to the next step, but it spit out some errors in the top of the page..

I kept going, had some more problems...reuploaded a good copy of the install.php file...then went through some more, had problems lmao!! I then even got to the point of downloading the config.php, uploaded it, hit done or whatever, it said no databases were there, I went into the phpMyAdmin, imported the mysqlschema file and had the tables added...

Deleted the install/ directory...went to the /forum/ location, and got a basic blank page with a message at top about "removing" or "not removing" the common.php file, you will then lose support... :?

I'm not sure now, but I have it all back to the way it was to start with lol! Dropped the tables in the database, uploaded a new install/ directory again with fresh copies..and a blank config.php.....Sooo.. I'm back to this php call tag for the globals in the .htaccess file now.. Please read the initial first couple of paragraphs.. Thanks in advance...

spencerp
code reader
Registered User
Posts: 653
Joined: Wed Sep 21, 2005 3:01 pm

Re: phpBB 3.x.x and register_global ...

Post by code reader »

spencerp wrote: My host said to add this line in it:

Code: Select all

php_value register_globals 1
So how is the end result of it supposed to be lol!? I'm not the greatest for messing with the .htaccess file, but just copying and pasting that above code into the .htaccess file, didn't do anything...
maybe because the line above turns register_globals ON.
to turn it off change the 1 to 0.
also, according to php documentation, for register_globals you are supposed to use php_flag. it is entirely possible that php_value should also work, but fwiw, the php doc show this line:

Code: Select all

php_flag register_globals off
as to the question "where in the .htaccess file should i add it?"
A. add it as the first line, outside of any <Directive>....</Directive> block.
spencerp
Registered User
Posts: 6
Joined: Mon Feb 27, 2006 10:20 am
Contact:

Re: phpBB 3.x.x and register_global ...

Post by spencerp »

code reader wrote:
spencerp wrote: My host said to add this line in it:

Code: Select all

php_value register_globals 1
So how is the end result of it supposed to be lol!? I'm not the greatest for messing with the .htaccess file, but just copying and pasting that above code into the .htaccess file, didn't do anything...
maybe because the line above turns register_globals ON.
to turn it off change the 1 to 0.
also, according to php documentation, for register_globals you are supposed to use php_flag. it is entirely possible that php_value should also work, but fwiw, the php doc show this line:

Code: Select all

php_flag register_globals off
as to the question "where in the .htaccess file should i add it?"
A. add it as the first line, outside of any <Directive>....</Directive> block.
Hahaha, flucking hell yeah!! Thanks so much man... Yeah I wasn't sure about that code my host told me to do because I'm just not familiar with that stuff... But this did work on the first attempt..

Code: Select all

php_flag register_globals off
Thanks a million man..

spencerp
alcaeus
Registered User
Posts: 66
Joined: Sun Oct 10, 2004 3:21 am
Location: Munich (Germany)
Contact:

Re: phpBB 3.x.x and register_global ...

Post by alcaeus »

Lieutenant Clone wrote: The second comprimise would be to allow install of the script with register_globals on, and flag their board as having it on) but deny those users support(untill they turn it off).
Oh boy, you don't have any idea of what it means to support dumb users, do you? Just imagine these scenarios:
Sc. 1: 14yr old kid wants forum, finds phpBB. Downloads it, writes his "PHPbb rul0rZ" post somewhere. Gets some free php webspace, uploads phpBB, tries to install it, doesn't work because of register_globals. Let's just say it: he's f***ed
Sc. 2: 14yr old kid wants forum, finds phpBB. Downloads it, writes his "PHPbb rul0rZ" post somewhere. Gets some free php webspace, uploads phpBB, tries to install it, and it gives him a warning about register_globals. He ignores it, works on the board. Then he realizes some "bug" because he forgot to change some permission for a folder. Goes to phpbb.com, asks for support, and is told to help himself because register_globals is on, and he has no chance of turning it off.

Isn't life sweet? :)

Bottom line: not everything that makes sense to an advanced user makes sense to the average Joe ;)

And that's my $0.02

Greetz
alcaeus
Post Reply