Problem wrapping PHP scripts with php-cgiwrap

classic Classic list List threaded Threaded
3 messages Options
Reply | Threaded
Open this post in threaded view
|

Problem wrapping PHP scripts with php-cgiwrap

MJ Patterson
Sorry if this is off-topic, because it's not actually a Mediawiki issue (I
don't think), but I'm going to throw this out to see if anyone has had a
similar issue and has had any success resolving it.

My host has a directory structure that is not secure (for web files).  Web
files are viewable by all accounts that are on the same machine (necessary
because Apache does not run under my ID - so my files have to be 705).
This means that index.php, which contains the database id and password, is
readable by any of the host's other customers who are on 'my' server who
browse my www subdir.  I have removed AdminSettings.php, and am using a
r/w user in index.php instead of a full access user.  But I am still
uncomfortable  with having the the r/w user ID and pw 'out there'.

The host provides a wrapper, php-cgiwrap, that will wrap my php files so
that they run under my ID.  Then I can set the permissions to 700 and
nobody else can see index.php.

This works fine for a standard test PHP script that just outputs PHPInfo.
However, when I feed it the site URL http://www.waterwiki.org/ww/index.php
the script, as designed, redirects to
http://www.waterwiki.org/ww/index.php/Main_Page.  This confuses
php-cgiwrap because it looks for script called Main_Page and can't find it
resulting in an error "No input file specified".
This can be seen in my sandbox:
http://www.waterwiki.org/sb/index.php

I contacted the host support guys and they said it's working as designed,
see if there's a workaround.  I found nothing in the list archive or on
meta about php script wrapping, so here I am.

Apologies for the long-winded description.

/mjp

_______________________________________________
MediaWiki-l mailing list
[hidden email]
http://mail.wikipedia.org/mailman/listinfo/mediawiki-l
Reply | Threaded
Open this post in threaded view
|

Re: Problem wrapping PHP scripts with php-cgiwrap

Brion Vibber
[hidden email] wrote:
> This works fine for a standard test PHP script that just outputs PHPInfo.
> However, when I feed it the site URL http://www.waterwiki.org/ww/index.php
> the script, as designed, redirects to
> http://www.waterwiki.org/ww/index.php/Main_Page.  This confuses
> php-cgiwrap because it looks for script called Main_Page and can't find it
> resulting in an error "No input file specified".

You'll need to disable pretty URLs. Your default LocalSettings.php will include
two sample lines setting $wgArticlePath; uncomment the one that's commented and
comment the one that's uncommented.

-- brion vibber (brion @ pobox.com)


_______________________________________________
MediaWiki-l mailing list
[hidden email]
http://mail.wikipedia.org/mailman/listinfo/mediawiki-l

signature.asc (257 bytes) Download Attachment
Reply | Threaded
Open this post in threaded view
|

Re: Problem wrapping PHP scripts with php-cgiwrap

MJ Patterson
Brion Vibber wrote:
> You'll need to disable pretty URLs. Your default LocalSettings.php will include
> two sample lines setting $wgArticlePath; uncomment the one that's commented and
> comment the one that's uncommented.

That did the trick.  Thanks.

Now to decide which I want more: security or pretty URLs.

/mjp

_______________________________________________
MediaWiki-l mailing list
[hidden email]
http://mail.wikipedia.org/mailman/listinfo/mediawiki-l