Re: problem: Debian apache2 + php4-cgi + attachments

On Jan 04, 2004, at 15:55, Moritz Bunkus wrote:

> I use Debian on my server along with apache2. The problem is that
> Debian, due to some obscur threading problems, does not provide php4
> packets with apache2 support, so the only way of using php4 with 
> apache2
> is php4-cgi. This in turn poses problems with the new 'view attachment'
> syntax using a complete path,
> e.g. https://www.bunkus.org/anthill/showattachment.php/21/a.txt
> On this installation I only get 404 in my logs and the text "No input
> file specified." is sent to the web browser.
>
> Any chance you could re-think this please? Is there a good reason for
> not doing it the 'usual' way? Perhaps you don't have to protect against
> path traversing attacks that way, dunno...

Hmmm...  doing it this way gives us a lot of benefits.  For one, it's 
more secure (although, arguably, i can make the old style just a 
secure).  But one big reason is that if you go to 
showattachment.php/21/a.txt if you do a "save as" in your browser, the 
file will be saved as a.txt.  If we did showattachment?id=21 then the 
file would be saved as showattachment.php which obviously is incorrect. 
  There was some code submitted that turned the showattachment page into 
a "summary" page with a link to download, but I didn't really like 
that... it didn't feel smooth to me.  It felt like a clumsy hack 
(which, incidentally, introduced some security problems too).

I think what you might want to do is use apache 1.3.  After having a 
few discussions with people, apache2+php is not really a good match.  
Some really big PHP apps just don't work properly.  Thankfully, Anthill 
does for the most part.

If that isn't an option, I'm not sure what you can attempt to do short 
of compiling PHP for apache2 yourself.  I don't really want to change 
how the attachments are handled because I think this way is "smart".

---
MandrakeSoft Security; http://www.mandrakesecure.net/
Online Security Resource Book; http://linsec.ca/
"lynx -source http://linsec.ca/vdanen.asc | gpg --import"
{FE6F2AFD : 88D8 0D23 8D4B 3407 5BD7  66F9 2043 D0E5 FE6F 2AFD}

_______________________________________________
Anthill-workers mailing list
Anthill-workers-+mQDA36h6dWw5LPnMra/[email protected]
http://vmlinuz.ca/mailman/listinfo/anthill-workers