Opened 111 minutes ago
Last modified 16 minutes ago
#592 new defect
CRITICAL: Security recommendations to php.ini
| Reported by: | Jeff McKenna | Owned by: | Jeff McKenna |
|---|---|---|---|
| Priority: | critical | Milestone: | 5.2.1 release |
| Component: | MS4W - PHP | Version: | 5.2.0 |
| Keywords: | Cc: | Sven Schroeter, TC Haddad | |
| Blocked By: | Blocking: | #559 |
Description
- related to effort to upgrade PHP through #559
- reported by @netgis:
The php.ini shipped with 5.2.0 sets display_errors = On and enable_dl = On.
It leaves session.use_strict_mode, session.cookie_httponly and
session.upload_progress.enabled at their defaults, and the last one is one
of the attack paths for CVE-2026-109619. On public servers we switched
all of these to production values. It might be worth making those the defaults,
or adding a note to README_INSTALL.
Change History (2)
comment:1 by , 102 minutes ago
| Blocking: | 559 added |
|---|
comment:2 by , 16 minutes ago
| Summary: | Security recommendations to php.ini → CRITICAL: Security recommendations to php.ini |
|---|
Note:
See TracTickets
for help on using tickets.
