PHP Security Tweaks

2008-05-23 Thread Jeffrey Tadlock
I asked yesterday in the meeting about any modifications made to the default PHP install to help tighten things up a little with MediaWiki quite close to going into production. I took a look at the php.ini file on publictest2 and have a couple of suggestions to make - please feel free to comment o

Re: PHP Security Tweaks

2008-05-23 Thread Mike McGrath
On Fri, 23 May 2008, Jeffrey Tadlock wrote: > I asked yesterday in the meeting about any modifications made to the > default PHP install to help tighten things up a little with MediaWiki > quite close to going into production. I took a look at the php.ini > file on publictest2 and have a couple o

Re: PHP Security Tweaks

2008-05-24 Thread Jeffrey Tadlock
On Fri, May 23, 2008 at 9:08 PM, Mike McGrath <[EMAIL PROTECTED]> wrote: > On Fri, 23 May 2008, Jeffrey Tadlock wrote: >> * Change 'allow_url_fopen' to Off. >> >> * Set 'expose_php' to Off. >> >> * Set 'display_errors' to Off >> >> * Set the upload_tmp_dir to a location that is only accessible by t

Re: PHP Security Tweaks

2008-05-25 Thread Jeffrey Tadlock
On Sat, May 24, 2008 at 10:18 PM, Jeffrey Tadlock <[EMAIL PROTECTED]> wrote: > 'open_basedir' is causing issues with the user's page (i.e. clicking > the jeffreyt link at the top of the page), when it is enabled it just > goes to a blank page. The same happens with the Infrastructure page > as wel

Re: PHP Security Tweaks

2008-05-25 Thread Mike McGrath
On Sun, 25 May 2008, Jeffrey Tadlock wrote: > On Sat, May 24, 2008 at 10:18 PM, Jeffrey Tadlock <[EMAIL PROTECTED]> wrote: > > 'open_basedir' is causing issues with the user's page (i.e. clicking > > the jeffreyt link at the top of the page), when it is enabled it just > > goes to a blank page. T

Re: PHP Security Tweaks

2008-05-25 Thread Mike McGrath
On Sun, 25 May 2008, Jeffrey Tadlock wrote: > On Sat, May 24, 2008 at 10:18 PM, Jeffrey Tadlock <[EMAIL PROTECTED]> wrote: > > 'open_basedir' is causing issues with the user's page (i.e. clicking > > the jeffreyt link at the top of the page), when it is enabled it just > > goes to a blank page. T

Re: PHP Security Tweaks

2008-05-26 Thread Jeffrey Tadlock
On Sun, May 25, 2008 at 11:40 PM, Mike McGrath <[EMAIL PROTECTED]> wrote: > Side note about this, it seems to have broken OpenID support. I've > reverted to a default configuration so ricky can continue testing. If > you've got a moment could you hook up with him at some point and find out > exac

Re: PHP Security Tweaks

2008-05-31 Thread Jeffrey Tadlock
I took a look at pt2 again today and it looks like the php.ini was set back to the default after Ricky and I sorted out the OpenID issues on Monday. Was the more restrictive version causing troubles for someone? I would be happy to look at what was going on - so far we've been able to adjust it t

Re: PHP Security Tweaks

2008-05-31 Thread Mike McGrath
On Sat, 31 May 2008, Jeffrey Tadlock wrote: > I took a look at pt2 again today and it looks like the php.ini was set > back to the default after Ricky and I sorted out the OpenID issues on > Monday. > > Was the more restrictive version causing troubles for someone? I > would be happy to look at w

Re: PHP Security Tweaks

2008-05-31 Thread Jeffrey Tadlock
On Sat, May 31, 2008 at 11:30 AM, Mike McGrath <[EMAIL PROTECTED]> wrote: > Sorry, I'll set that back to how it was. I moved it to test some strange > things that were happening. Cool! Thanks Mike. I wasn't sure if it had caused issues again or not. I was giving it some time to sit on publicte

Re: PHP Security Tweaks

2008-05-31 Thread Mike McGrath
On Sat, 31 May 2008, Jeffrey Tadlock wrote: > On Sat, May 31, 2008 at 11:30 AM, Mike McGrath <[EMAIL PROTECTED]> wrote: > > Sorry, I'll set that back to how it was. I moved it to test some strange > > things that were happening. > > Cool! Thanks Mike. I wasn't sure if it had caused issues again