https://www.icyphoenix.com/viewtopic.php?f=4&t=2682
-----------------------------------
novice programmer
Sat 25 Aug, 2007 17:15

HOSTING - Modify Php Settings With .htaccess File
-----------------------------------
If you recive a error like this:

[code linenumbers=false]
Allowed memory size of (number1) bytes exausted when tried to allocate (number2) bytes on (file)
[/code]

And "number1" is smaller than "number2", that´s because icy don´t has been configured for a smaller Php allowed memory usage, that is cofigurated in most servers. For solving that:

OPEN [b]"board_root"/.htaccess[/b]
FIND
[codeblock]#php_value memory_limit 32M[/codeblock]
REPLACE WITH
[codeblock]php_value memory_limit 32M[/codeblock]

Important: the 32 can be any other number, but it has to be a multiple of 8.

[hr]

If you need to set the register_globals configuration off (without modifying the php.ini):

OPEN [b]"board_root"/.htaccess[/b]
FIND
[codeblock]#php_flag register_globals 0
#php_flag register_globals off[/codeblock]
REPLACE WITH
[codeblock]php_flag register_globals 0
php_flag register_globals off[/codeblock] 

[hr]

If you want to set the icy board error pages:

OPEN [b]"board_root"/.htaccess[/b]
FIND
[codeblock]#ErrorDocument 400 http://127.0.0.1/errors.php?code=400
#ErrorDocument 401 http://127.0.0.1/errors.php?code=401
#ErrorDocument 403 http://127.0.0.1/errors.php?code=403
#ErrorDocument 404 http://127.0.0.1/errors.php?code=404
#ErrorDocument 500 http://127.0.0.1/errors.php?code=500[/codeblock]
REPLACE WITH
[codeblock]ErrorDocument 400 http://127.0.0.1/errors.php?code=400
ErrorDocument 401 http://127.0.0.1/errors.php?code=401
ErrorDocument 403 http://127.0.0.1/errors.php?code=403
ErrorDocument 404 http://127.0.0.1/errors.php?code=404
ErrorDocument 500 http://127.0.0.1/errors.php?code=500[/codeblock]

Note: You have to put your website instead of "http://127.0.0.1"

[hr]

To disable the rewrite engine (it doesn´t mind what is set in the acp):

OPEN [b][/b]
FIND
[codeblock]RewriteEngine On[/codeblock]
REPLACE WITH
[codeblock]RewriteEngine Off[/codeblock]

[hr]

To sure that you won´t have any error in the domain/subdomain adress:

OPEN [b]"board_root"/.htaccess[/b]
FIND
[codeblock]#Make sure the whole site goes to www.mysite.com instead of mysite.com. This is good for the search engines
#Edit and uncomment the below lines for your own site.
#Make sure to replace icyphoenix.com with your site address.
#RewriteCond %{HTTP_HOST} ^icyphoenix.com
#RewriteRule (.*) http://www.icyphoenix.com/$1 [R=301,L][/codeblock]
REPLACE WITH
[codeblock]#Make sure the whole site goes to www.mysite.com instead of mysite.com. This is good for the search engines
#Edit and uncomment the below lines for your own site.
#Make sure to replace icyphoenix.com with your site address.
RewriteCond %{HTTP_HOST} ^icyphoenix.com
RewriteRule (.*) http://www.icyphoenix.com/$1 [R=301,L][/codeblock]

Note: This time you have to put your Url on the first without the "www." if you have a domain or with the www. if you haven´t one, and in the second in the inverse way.

[hr]


MG, have you thought about, in the file .htaccess, add something to block the characters below?

[code linenumbers=false]
",',<,>,{,},[,]
[/code]


-----------------------------------
Mighty Gorgon
Sat 25 Aug, 2007 18:34

Re: Modify Php Settings With .htaccess File
-----------------------------------
Thanks, it is really useful, I'll move to docs section.

[quote user="novice programmer" post="18932"]MG, have you thought about, in the file .htaccess, add something to block the characters below?

[code linenumbers=false]
",',<,>,{,},[,]
[/code][/quote]
Why should I block these?

Not all of these requests may be dangerous... :roll:

I can't lock all these kind of requests, because someone may need them for other scripts on their sites.


-----------------------------------
buldo
Sun 26 Aug, 2007 00:12

Re: Modify Php Settings With .htaccess File
-----------------------------------
Many thanks, novice programmer, very useful! :up:


-----------------------------------
novice programmer
Sun 26 Aug, 2007 21:36

Re: Modify Php Settings With .htaccess File
-----------------------------------
[quote user="Mighty Gorgon" post="18933"]Thanks, it is really useful, I'll move to docs section.

[quote user="novice programmer" post="18932"]MG, have you thought about, in the file .htaccess, add something to block the characters below?

[code linenumbers=false]
",',<,>,{,},[,]
[/code][/quote]
Why should I block these?

Not all of these requests may be dangerous... :roll:

I can't lock all these kind of requests, because someone may need them for other scripts on their sites.[/quote]

About the < and >: With the <HTML TEXT> you can insert  a script at the adress. I konw you have blocked all script tags on the url, but it could be ofuscated... it´ll become this way: <D5%110%25%2001%20%>. For my POV this is a security issue.

For possible hackers: The numbers have been selected at ramdom, and them won´t work in a page.

About the ': I know ctraker blocks them, but if someone can insert into the url a code for not-ctraker loading...

About the ": Php code could being edited with them

And about the { and }: I don´t know any page which use them, so they could be blocked.

MG, if you found this risky, you can upload them as a customization, so users could decide.

You can add this to the acronyms:
POV = Point Of View


-----------------------------------
Mighty Gorgon
Mon 27 Aug, 2007 21:07

Re: Modify Php Settings With .htaccess File
-----------------------------------
Yes of course it is a matter of POV :wink: !

In my opinion scripts must be secured against these kind of requests, but I wouldn't block everything just because they may be dangerous.

If a script is well coded, then these measures will be unuseful.

There are always two extreme ways in adopting securities measures:
[list][*]Block everything may be dangerous...
[*]Try to guess at runtime what may be dangerous and eventually block unsecure scripts...[/list]

If you need something flexible, you should allow some vars being processed, but escaped where needed.

In PHP there are many functions for this, such as urlencode, raw_urlencode, htmlspecialchars and so on that are there just to prevent injections.

As you can see in major packages none of them is blocking so strictly some chars.

What I did in Icy Phoenix was to secure http requests by blocking injections via globals... so phpbb_root_path is blocked because it may be exposed to RFI (Remote File Inclusions) in those servers with globals enabled.

Anyway I really appreciate your point of view, and I hope you will post more of this, maybe someone will decide to follow your "hard" way and include a more strict htaccess to their sites.

Can you create a new htaccess including all these measures?


-----------------------------------
novice programmer
Tue 28 Aug, 2007 00:07

Re: Modify Php Settings With .htaccess File
-----------------------------------
[quote user="Mighty Gorgon" post="19017"]Yes of course it is a matter of POV :wink: !

In my opinion scripts must be secured against these kind of requests, but I wouldn't block everything just because they may be dangerous.

......

Can you create a new htaccess including all these measures?[/quote]

I asked you because i know something about php, but not about .htaccess files.


-----------------------------------
buldo
Tue 28 Aug, 2007 09:09

Re: Modify Php Settings With .htaccess File
-----------------------------------
[quote user="novice programmer" post="18932"]If you recive a error like this:

[code linenumbers=false]
Allowed memory size of (number1) bytes exausted when tried to allocate (number2) bytes on (file)
[/code]

And "number1" is smaller than "number2", that´s because icy don´t has been configured for a smaller Php allowed memory usage, that is cofigurated in most servers. For solving that:

OPEN [b]"board_root"/.htaccess[/b]
FIND
[codeblock]#php_value memory_limit 32M[/codeblock]
REPLACE WITH
[codeblock]php_value memory_limit 32M[/codeblock]

Important: the 32 can be any other number, but it has to be a multiple of 8.
[/quote]

A simple test (actual limit is 12M, I tried 32MB) on my host has returned this error (500):

[quote]Internal Server Error

The server encountered an internal error or misconfiguration and was unable to complete your request.

Please contact the server administrator, and inform them of the time the error occurred, and anything you might have done that may have caused the error.

More information about this error may be available in the server error log.[/quote]

Is there any other setting to modify?  :roll:


-----------------------------------
Zuker
Tue 28 Aug, 2007 13:17

Re: Modify Php Settings With .htaccess File
-----------------------------------
Your server does not support that value. They set up that value on on every account by default


-----------------------------------
buldo
Tue 28 Aug, 2007 13:32

Re: Modify Php Settings With .htaccess File
-----------------------------------
[quote user="Zuker" post="19053"]Your server does not support that value. They set up that value on on every account by default[/quote]

As I supposed  :x 

Thanks, Zuker


-----------------------------------
novice programmer
Tue 28 Aug, 2007 22:49

Re: Modify Php Settings With .htaccess File
-----------------------------------
[quote user="buldo" post="19049"]
....

A simple test (actual limit is 12M, I tried 32MB) on my host has returned this error (500):

...
[/quote]
I have only tested the 8M multiples.

Notice that you have only to set the M for Megabyte. If you put MB, it won´t work.


-----------------------------------
buldo
Tue 28 Aug, 2007 23:10

Re: Modify Php Settings With .htaccess File
-----------------------------------
[quote user="novice programmer" post="19063"]
Notice that you have only to set the M for Megabyte. If you put MB, it won´t work.[/quote]

I know. I've tried with 32M, but most problably Zuker is right  :(


-----------------------------------
Mighty Gorgon
Wed 29 Aug, 2007 00:52

Re: Modify Php Settings With .htaccess File
-----------------------------------
[b]buldo[/b], you don't need to set it via HTACCESS, because you can set it via PHP on your server...

Why you want to raise Memory Limit? Are you having white pages or some other warning?


_______________

[quote user="novice programmer" post="19037"][quote user="Mighty Gorgon" post="19017"]Yes of course it is a matter of POV :wink: !

In my opinion scripts must be secured against these kind of requests, but I wouldn't block everything just because they may be dangerous.

......

Can you create a new htaccess including all these measures?[/quote]

I asked you because i know something about php, but not about .htaccess files.[/quote]
When I have some free time I'll try to have a play to show you how to block some special chars.

If you have time, there are several sites which helps users in coding their HTACCESS.


-----------------------------------
buldo
Wed 29 Aug, 2007 09:01

Re: Modify Php Settings With .htaccess File
-----------------------------------
[quote user="Mighty Gorgon" post="19070"][b]buldo[/b], you don't need to set it via HTACCESS, because you can set it via PHP on your server...

Why you want to raise Memory Limit? Are you having white pages or some other warning? [/quote]

I've got a "Memory execed limit"  with "Rebuild search index" in ACP->DB Maintenance, using the standard IP parameters. 
I must reduce "Max post size" in  ACP->DB Maintenance->Configuration to 250 to complete the task.

I've also tried to insert "ini_set('memory_limit','32M');" in config.php as suggested on other post, but the error remains.

Ciao,


-----------------------------------
novice programmer
Thu 30 Aug, 2007 23:30

Re: Modify Php Settings With .htaccess File
-----------------------------------
[quote user="buldo" post="19049"]
...............
A simple test (actual limit is 12M, I tried 32MB) on my host has returned this error (500):
..........
[/quote]

If can´t set memory at 32M, try with 16M, and if it doesn´t work, set it at 12M. Try it out with the two ways.

I recomend setting up at a multiple of 8M becase that are the valves I´ve tested. You can try with the ones you want.


-----------------------------------
buldo
Fri 31 Aug, 2007 00:17

Re: Modify Php Settings With .htaccess File
-----------------------------------
Actual limit is 12M. I've also tried 16M, but it doesn't work.

Anyway, thanks for your tips. :up:


-----------------------------------
novice programmer
Fri 31 Aug, 2007 00:42

Re: Modify Php Settings With .htaccess File
-----------------------------------
[quote user="buldo" post="19139"]Actual limit is 12M. I've also tried 16M, but it doesn't work.

Anyway, thanks for your tips. :up:[/quote]

You are welcome.


-----------------------------------
Mighty Gorgon
Sun 02 Sep, 2007 12:07

Re: Modify Php Settings With .htaccess File
-----------------------------------
[quote user="buldo" post="19083"]I've got a "Memory execed limit"  with "Rebuild search index" in ACP->DB Maintenance, using the standard IP parameters. 
I must reduce "Max post size" in  ACP->DB Maintenance->Configuration to 250 to complete the task.

I've also tried to insert "ini_set('memory_limit','32M');" in config.php as suggested on other post, but the error remains.

Ciao,[/quote]
That is strange... it worked for me, and we are with the same provider.

In any case if reducing posts it works... then reduce them! :wink:


-----------------------------------
buldo
Sun 02 Sep, 2007 17:30

Re: Modify Php Settings With .htaccess File
-----------------------------------
[quote user="Mighty Gorgon" post="19221"]
In any case if reducing posts it works... then reduce them! :wink:[/quote]

It can be useful for other applications that require more memory to work.


-----------------------------------
Mighty Gorgon
Sun 09 Sep, 2007 01:59

Re: Modify Php Settings With .htaccess File
-----------------------------------
Yes, but it is not suitable to raise memory... only in exceptional case you should do that, not on a regular basis, because the server may suffer higher memory requests.


