DETAILS:

The PHP parameter allow_url_fopen has been disabled in both our PHP4 and PHP5 environments for the (gs) Grid-Service.

BACKGROUND:

If enabled, allow_url_fopen allows PHP's file functions to retrieve data from remote locations such as an FTP server or web site, and could lead to code injection vulnerabilities. Typically these code injection vulnerabilities occur from improper input filtering when passing user-provided data to PHP functions. Disabling this function will help considerably in stopping your site(s) from being compromised, as well as help thwart the unauthorized use of our servers for abusive or malicious purposes.

WHAT YOU SHOULD DO:

We would highly suggest further researching and examining aspects of your site's code that depend on this functionality. There are many safer methods to accomplish the same desired results without this possible security issue.

• Use a relative path to the file stored locally
• Using the PHP environment variable $_SERVER['DOCUMENT_ROOT'], which returns the absolute path to the web root directory.
• cURL is another method that could be used. (This method is beyond the scope of this article.)

If this software was obtained from a 3rd party we suggest contacting their developer. These developers can usually be contacted via forums, email or other methods.

WORKAROUND:

You can enable 'allow_url_fopen' by editing your php.ini . The process is very straightforward; it is as simple as including the following line to your own php.ini file at /home/####/etc/php.ini (Replace the #### with your site number) If you are just starting to use a custom php.ini file you may need to also change the memory_limit value as well.

allow_url_fopen = On

Q&A

Q: After making this change my sites no longer work and I get the error "Fatal error: Allowed memory size of 8388608 bytes exhausted..", how do I fix this?

A: Please be sure to also add the following to your php.ini.

memory_limit = 100M
cgi.fix_pathinfo=1

Revisions:

07-20-2009: Minor Fixes