ID: 28454 User updated by: bugs dot php dot net at phoenixdigital dot com Reported By: bugs dot php dot net at phoenixdigital dot com -Status: Bogus +Status: Open -Bug Type: Documentation problem +Bug Type: *Configuration Issues Operating System: Freebsd 4.9 Stable PHP Version: 4.3.4 New Comment:
Actually come to think of it I have moved this back into the config issues as a bug because you thought I was talking about a .htaccess file. It is fair enough that you limit the modification of sendmail_path in a .htaccess file. However as the manual states you CAN modify this in the httpd.conf which is where we are trying to modify it. Since htttp.conf files are generally only controlled by administrators then this is not a security issue. Previous Comments: ------------------------------------------------------------------------ [2004-05-20 12:44:19] [EMAIL PROTECTED] It can be set in httpd.conf, just not in a virtual host setting. ------------------------------------------------------------------------ [2004-05-20 12:35:35] bugs dot php dot net at phoenixdigital dot com Also you said I can't set in in .htaccess I am not being picky but I did state that I am trying to set it in the httpd.conf which is completely different. ------------------------------------------------------------------------ [2004-05-20 12:33:27] bugs dot php dot net at phoenixdigital dot com Then this is a documentation issue because on this page http://au.php.net/ini_set sendmail_path DEFAULT_SENDMAIL_PATH PHP_INI_SYSTEM where PHP_INI_SYSTEM 4 Entry can be set in php.ini or httpd.conf It claims you CAN set it in a httpd.conf NOT ------------------------------------------------------------------------ [2004-05-20 12:26:45] [EMAIL PROTECTED] This is not a bug, but meant to work like this due to security reasons. (Ie, we don't want people to be able to configure their own sendmail path in .htaccess files). The correct way of doing what you want is to use the php_admin_value mail.force_extra_parameters setting, which is configurable per vhost.. unfortunately that only works in PHP 5 (dev). If you are comfortable patching, you can apply the following patch to php 4.3.6 (it should also apply to 4.3.4): Index: main/main.c =================================================================== RCS file: /repository/php-src/main/main.c,v retrieving revision 1.512.2.53 diff -u -p -r1.512.2.53 main.c --- main/main.c 9 Feb 2004 04:05:56 -0000 1.512.2.53 +++ main/main.c 20 May 2004 10:26:04 -0000 @@ -356,7 +356,7 @@ PHP_INI_BEGIN() #endif PHP_INI_ENTRY("precision", "14", PHP_INI_ALL, OnSetPrecision) PHP_INI_ENTRY("sendmail_from", NULL, PHP_INI_ALL, NULL) - PHP_INI_ENTRY("sendmail_path", DEFAULT_SENDMAIL_PATH, PHP_INI_SYSTEM, NULL) + PHP_INI_ENTRY("sendmail_path", DEFAULT_SENDMAIL_PATH, PHP_INI_SYSTEM|PHP_INI_PERDIR, NULL) PHP_INI_ENTRY("disable_functions", "", PHP_INI_SYSTEM, NULL) PHP_INI_ENTRY("disable_classes", "", PHP_INI_SYSTEM, NULL) But make sure to use php_admin_value sendmail_path "your command" so that it can't be overridden from .htaccess files. ------------------------------------------------------------------------ [2004-05-20 09:08:44] bugs dot php dot net at phoenixdigital dot com if possible can you please adjust the email address in my bug report to be a non real domain as I don't want my email to be trawled from this bug report. please change it to php_value sendmail_path '/usr/sbin/sendmail -t -i -f [EMAIL PROTECTED]' Thanks ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at http://bugs.php.net/28454 -- Edit this bug report at http://bugs.php.net/?id=28454&edit=1
