Opened 6 days ago

Closed 4 days ago

#592 closed defect (fixed)

CRITICAL: Security recommendations to php.ini

Reported by: Jeff McKenna Owned by: Jeff McKenna
Priority: critical Milestone: 5.2.1 release
Component: MS4W - PHP Version: 5.2.0
Keywords: Cc: Sven Schroeter, TC Haddad
Blocked By: Blocking: #559

Description

  • related to effort to upgrade PHP through #559
  • reported by @netgis:

The php.ini shipped with 5.2.0 sets display_errors = On and enable_dl = On.
It leaves session.use_strict_mode, session.cookie_httponly and
session.upload_progress.enabled at their defaults, and the last one is one
of the attack paths for CVE-2026-109619. On public servers we switched
all of these to production values. It might be worth making those the defaults,
or adding a note to README_INSTALL.

Change History (3)

comment:1 by Jeff McKenna, 6 days ago

Blocking: 559 added

comment:2 by Jeff McKenna, 6 days ago

Summary: Security recommendations to php.ini → CRITICAL: Security recommendations to php.ini

comment:3 by Jeff McKenna, 4 days ago

Resolution: → fixed
Status: new → closed

updates

  • MS4W 5.2.1 includes the following set in php.ini : 
                                  display_errors: disabled
                                   enable_dl: disabled
                     session.use_strict_mode: enabled
                     session.cookie_httponly: enabled
             session.upload_progress.enabled: disabled
  • the README_INSTALL document includes that note
Note: See TracTickets for help on using tickets.