Hi, for some reason force_redirect shows up as disabled even though set to on in my /etc/php5/cgi/php.ini file.

I've restarted PHP multiple times and even changed the value in all the other php.ini files using locate.

Is this a security concern or not?

Is it possible that php was built without it?

What is the output of

# php -v

# php -i | grep enable-force-cgi-redirect

--
Jim Ohlstein

It returns nothing. I just used [code]
apt-get install php5-common php5-dev php5-mysql php5-tidy php5-xmlrpc php5-xsl php5-cgi php5-mcrypt php5-curl php5-gd php5-memcache php5-mhash php5-pspell php5-snmp php5-cli memcached
[/code]
on Ubuntu LTS.

Am I gonna have to build PHP from source? I could upgrade Ubuntu but my boot partition is too small right now so I'd rather not.

It seems that it was built without it then. If it were you would see something like:


# php -v
PHP 5.2.12 with Suhosin-Patch 0.9.7 (cli) (built: Jan 19 2010 15:54:10)
Copyright (c) 1997-2009 The PHP Group
Zend Engine v2.2.0, Copyright (c) 1998-2009 Zend Technologies
with XCache v1.3.0, Copyright (c) 2005-2009, by mOo

# php -i | grep enable-force-cgi-redirect
Configure Command => './configure' '--with-layout=GNU' '--with-config-file-scan-dir=/usr/local/etc/php' '--disable-all' '--enable-libxml' '--with-libxml-dir=/usr/local' '--enable-reflection' '--program-prefix=' '--enable-force-cgi-redirect' '--enable-fastcgi' '--with-regex=php' '--with-zend-vm=CALL' '--enable-zend-multibyte' '--prefix=/usr/local' '--mandir=/usr/local/man' '--infodir=/usr/local/info/' '--build=amd64-portbld-freebsd8.0'

What version of PHP is it? That configure option is no longer available in 5.3. The logic evidently is built into PHP 5.3 by default.

--
Jim Ohlstein

It's PHP version 5.2.4. I think I'm just gonna upgrade Ubuntu. I already had to build openssh from source just to jail users =P.