Cacti (home)ForumsRepositoryDocumentation
Cacti: offical forums and support  

 FAQFAQ   SearchSearch   MemberlistMemberlist    RegisterRegister   ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in    


Upgrade from 0.8.7a to 0.8.7b: 'Invalid PHP_SELF Path'
Goto page 1, 2, 3, 4  Next
 
Post new topic   Reply to topic    Cacti Forum Index -> Help: Linux/Unix Specific
Author Message
chronos



Joined: 12 Feb 2008
Posts: 5
PostPosted: Tue Feb 12, 2008 1:11 pm    Post subject: Upgrade from 0.8.7a to 0.8.7b: 'Invalid PHP_SELF Path' Reply with quote
On my FreeBSD server, I've updated through the ports system from 8.7a to 8.7b and now I get the following message:

Invalid PHP_SELF Path

I also tried going to /install/index.html but it gives the same message.

This is my config.php file:

$database_type = "mysql";
$database_default = "cacti";
$database_hostname = "localhost";
$database_username = "somethingi";
$database_password = "something";
$database_port = "3306";

Thanks for helping!
Back to top
fmangeant
Cacti Guru User


Joined: 19 Sep 2003
Posts: 2325
Location: Sophia-Antipolis, France
PostPosted: Tue Feb 12, 2008 2:23 pm    Post subject: Reply with quote
Hi

I had the same error when "beta testing" 0.8.7b, but it was fixed.

Can you add this to include/global.php before the "Sanity Check on 'Corrupt' PHP_SELF" block :
Code:
print "<pre>";
print_r($_SERVER);
print "</pre>";

and post the result ?
Back to top
megaman



Joined: 11 Feb 2006
Posts: 3
PostPosted: Tue Feb 12, 2008 5:36 pm    Post subject: Reply with quote
I am using FreeBSD too.

Here is the result after adding your code :

Code:

Array
(
    [DOCUMENT_ROOT] => /usr/local/www/data
    [HTTP_ACCEPT] => text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
    [HTTP_ACCEPT_CHARSET] => iso-8859-1, utf-8, utf-16, *;q=0.1
    [HTTP_ACCEPT_ENCODING] => deflate, gzip, x-gzip, identity, *;q=0
    [HTTP_ACCEPT_LANGUAGE] => fr,en;q=0.9,ja;q=0.8,de;q=0.7,es;q=0.6,it;q=0.5,nl;q=0.4,sv;q=0.3,nb;q=0.2
    [HTTP_CACHE_CONTROL] => no-cache
    [HTTP_CONNECTION] => Keep-Alive, TE
    [HTTP_TE] => deflate, gzip, chunked, identity, trailers
    [PATH] => /sbin:/bin:/usr/sbin:/usr/bin:/usr/games:/usr/local/sbin:/usr/local/bin:/usr/X11R6/bin:/root/bin
    [REMOTE_ADDR] => 192.168.0.254
    [REMOTE_PORT] => 57188
    [SCRIPT_FILENAME] => /usr/local/share/cacti/index.php
    [SERVER_ADDR] => 192.168.0.1
    [SERVER_ADMIN] => you@your.address
    [SERVER_PORT] => 80
    [SERVER_SIGNATURE] =>
    [SERVER_SOFTWARE] => Apache
    [GATEWAY_INTERFACE] => CGI/1.1
    [SERVER_PROTOCOL] => HTTP/1.1
    [REQUEST_METHOD] => GET
    [QUERY_STRING] =>
    [REQUEST_URI] => /stats/index.php
    [SCRIPT_NAME] => /stats/index.php
    [PATH_TRANSLATED] => /usr/local/share/cacti/index.php
    [PHP_SELF] => /stats/index.php
    [REQUEST_TIME] => 1202855203
    [argv] => Array
        (
        )

    [argc] => 0
)


(I removed some variables about cookies and email address)

edit:
after looking to the code, I think it is a problem linked with the aliases' configuration of apache

mine is "alias /stats/ /usr/local/share/cacti/", and the tests done in global.php cant rebuild this path (or validate it)
Back to top
megaman



Joined: 11 Feb 2006
Posts: 3
PostPosted: Tue Feb 12, 2008 5:52 pm    Post subject: Reply with quote
A temporary solution would be to edit global.php like that :

comment this line:
Code:

if (!((is_file($_SERVER["SCRIPT_FILENAME"])) && (substr_count($_SERVER["SCRIPT_FILENAME"], $_SERVER["PHP_SELF"])))) {


add just under it:
Code:

                        if (!((is_file($_SERVER["SCRIPT_FILENAME"])))) {


but I dont know if this is secure or not, at least cacti is working again
Back to top
ben_c
Cacti User


Joined: 14 May 2007
Posts: 179
Location: Melbourne, Australia.
PostPosted: Tue Feb 12, 2008 8:02 pm    Post subject: Reply with quote
Hm, I might hold off on applying those patches for .7b based on this thread!
Back to top
chronos



Joined: 12 Feb 2008
Posts: 5
PostPosted: Tue Feb 12, 2008 9:28 pm    Post subject: Reply with quote
megaman wrote:
A temporary solution would be to edit global.php like that :

comment this line:
Code:

if (!((is_file($_SERVER["SCRIPT_FILENAME"])) && (substr_count($_SERVER["SCRIPT_FILENAME"], $_SERVER["PHP_SELF"])))) {


add just under it:
Code:

                        if (!((is_file($_SERVER["SCRIPT_FILENAME"])))) {


but I dont know if this is secure or not, at least cacti is working again


This does indeed work, but I hate modifying the code in that way to make things work. I hope they release a 0.8.7c version that really fixes the issue.

Thanks!
Back to top
davebassjunkie



Joined: 19 Nov 2007
Posts: 13
PostPosted: Tue Feb 12, 2008 11:44 pm    Post subject: Reply with quote
I'm getting the same error from applying the patch for 0.8.7a (multiple_vulnerabilities-0.8.7a.patch)

I'm not going to remove that line from the code, as that stops one of the XSS attacks that are the problem.

I have in my httpd.conf file in regards to the alias:

Alias /cacti "/local/cacti/"

Has anyone found a workaround that does not require removing an alias or taking out the security part?
Back to top
fmangeant
Cacti Guru User


Joined: 19 Sep 2003
Posts: 2325
Location: Sophia-Antipolis, France
PostPosted: Wed Feb 13, 2008 3:07 am    Post subject: Reply with quote
I've sent a PM to Larry about this error, which was supposed to be corrected in final release of 0.8.7b

(and I also renamed the first post)
Back to top
Gamb



Joined: 22 Nov 2007
Posts: 11
Location: France
PostPosted: Wed Feb 13, 2008 4:21 am    Post subject: Reply with quote
Hello,

I have same problem with $_SERVER["PHP_SELF"] :

Code:
Warning: is_file() [function.is-file]: open_basedir restriction in effect. File(/graph_view.php) is not within the allowed path(s): (/tmp:/usr/bin:/home/www/sessions:/usr/share/pear:/home/www/cacti:/usr/local/spine) in /home/www/cacti-0.8.7b/include/global.php on line 112


Just replace this condition :
Code:
if ((!is_file($_SERVER["PHP_SELF"])) && (!is_file($config["base_path"] . '/' . $_SERVER["PHP_SELF"]))) {


With this :
Code:
if (!is_file($config["base_path"] . '/' . $_SERVER["PHP_SELF"])) {
Back to top
TheWitness
Developer


Joined: 14 May 2002
Posts: 9697
Location: MI, USA
PostPosted: Wed Feb 13, 2008 6:59 am    Post subject: Reply with quote
I will send a note to the remainder of the developers. Those experiencing this problem need to post their tech support pages for me. Also, please post an error's you are getting in your Apache log.

In the mean time, apply the workaround. I believe that there may be no one solution to this issue.

Regards,

Larry
Back to top
chronos



Joined: 12 Feb 2008
Posts: 5
PostPosted: Wed Feb 13, 2008 7:58 am    Post subject: Reply with quote
Here's my _SERVER array:

Array
(
[UNIQUE_ID] => ss00HMCoAQoAAEZzUy4AAAAJ
[HTTP_HOST] => www.clkroot.net
[HTTP_USER_AGENT] => Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.8.1.12) Gecko/20080201 Firefox/2.0.0.12
[HTTP_ACCEPT] => text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
[HTTP_ACCEPT_LANGUAGE] => en-us,en;q=0.5
[HTTP_ACCEPT_ENCODING] => gzip,deflate
[HTTP_ACCEPT_CHARSET] => ISO-8859-1,utf-8;q=0.7,*;q=0.7
[HTTP_KEEP_ALIVE] => 300
[HTTP_CONNECTION] => keep-alive
[HTTP_COOKIE] => ************
[PATH] => /sbin:/bin:/usr/sbin:/usr/bin
[SERVER_SIGNATURE] =>
[SERVER_SOFTWARE] => Apache/2.2.8 (FreeBSD) mod_ssl/2.2.8 OpenSSL/0.9.8e DAV/2 PHP/5.2.5 with Suhosin-Patch mod_scgi/1.12
[SERVER_NAME] => www.clkroot.net
[SERVER_ADDR] => 192.168.1.10
[SERVER_PORT] => 80
[REMOTE_ADDR] => 81.85.237.5
[DOCUMENT_ROOT] => /usr/local/www/wordpress
[SERVER_ADMIN] => **************
[SCRIPT_FILENAME] => /usr/local/share/cacti/index.php
[REMOTE_PORT] => 53845
[GATEWAY_INTERFACE] => CGI/1.1
[SERVER_PROTOCOL] => HTTP/1.1
[REQUEST_METHOD] => GET
[QUERY_STRING] =>
[REQUEST_URI] => /sys_cacti/
[SCRIPT_NAME] => /sys_cacti/index.php
[PHP_SELF] => /sys_cacti/index.php
[REQUEST_TIME] => 1202907375
)

And my alias in my httpd.conf:
Alias /sys_cacti/ "/usr/local/share/cacti/"
Back to top
fmangeant
Cacti Guru User


Joined: 19 Sep 2003
Posts: 2325
Location: Sophia-Antipolis, France
PostPosted: Wed Feb 13, 2008 8:38 am    Post subject: Reply with quote
I can reproduice the problem by installing Cacti 0.8.7b in /home/cactiuser/test, with an Apache directory /foo :
Quote:
Invalid PHP_SELF Path

It seems that if the Apache directory name is not included in the directory's name where Cacti is installed, the substr_count($_SERVER["SCRIPT_FILENAME"], $_SERVER["PHP_SELF"]) function will fail.

We're now 3 in this thread having the same issue :
  • SCRIPT_FILENAME => /usr/local/share/cacti/index.php , PHP_SELF => /stats/index.php
  • SCRIPT_FILENAME => /usr/local/share/cacti/index.php , PHP_SELF => /sys_cacti/index.php
  • SCRIPT_FILENAME => /home/cactiuser/test/index.php , PHP_SELF => /foo/index.php
Back to top
dvl



Joined: 15 Nov 2006
Posts: 12
Location: Warrington, PA
PostPosted: Wed Feb 13, 2008 10:08 am    Post subject: Broken on FreeBSD too... Reply with quote
Gamb wrote:


Just replace this condition :
Code:
if ((!is_file($_SERVER["PHP_SELF"])) && (!is_file($config["base_path"] . '/' . $_SERVER["PHP_SELF"]))) {


With this :
Code:
if (!is_file($config["base_path"] . '/' . $_SERVER["PHP_SELF"])) {


That fix does not work for me. Some part below have been edited.

(
[DOCUMENT_ROOT] => /usr/websites/default/www
[HTTP_ACCEPT] => text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
[HTTP_ACCEPT_CHARSET] => iso-8859-1, utf-8, utf-16, *;q=0.1
[HTTP_ACCEPT_ENCODING] => deflate, gzip, x-gzip, identity, *;q=0
[HTTP_ACCEPT_LANGUAGE] => en-US,en;q=0.9
[HTTP_CACHE_CONTROL] => no-cache
[HTTP_CONNECTION] => Keep-Alive, TE
[HTTP_COOKIE] => PHPSESSID=*removed*; clickedFoldert2=1%5E; highlightedTreeviewLinkt2=2
[HTTP_COOKIE2] => $Version=1
[HTTP_HOST] => *removed*
[HTTP_TE] => deflate, gzip, chunked, identity, trailers
[HTTP_USER_AGENT] => Opera/9.25 (X11; FreeBSD 6 i386; U; en)
[PATH] => /sbin:/bin:/usr/sbin:/usr/bin:/usr/games:/usr/local/sbin:/usr/local/bin:/usr/X11R6/bin:/home/dan/bin
[REDIRECT_STATUS] => 200
[REDIRECT_UNIQUE_ID] => R7MHY0CTcSoAAWjNdz4
[REDIRECT_URL] => /cacti/
[REMOTE_ADDR] => 72.*removed*
[REMOTE_PORT] => 56795
[SCRIPT_FILENAME] => /usr/local/share/cacti//index.php
[SERVER_ADDR] => 64.*removed*
[SERVER_ADMIN] => dan@example.org
[SERVER_NAME] => 127.0.0.1
[SERVER_PORT] => 80
[SERVER_SIGNATURE] =>
[SERVER_SOFTWARE] => Apache
[UNIQUE_ID] => R7MHY0CTcSoAAWjNdz4
[GATEWAY_INTERFACE] => CGI/1.1
[SERVER_PROTOCOL] => HTTP/1.1
[REQUEST_METHOD] => GET
[QUERY_STRING] =>
[REQUEST_URI] => /cacti/
[SCRIPT_NAME] => /cacti/index.php
[PATH_TRANSLATED] => /usr/local/share/cacti//index.php
[PHP_SELF] => /cacti/index.php
[REQUEST_TIME] => 1202915171
[argv] => Array
(
)

[argc] => 0
)
Back to top
fmangeant
Cacti Guru User


Joined: 19 Sep 2003
Posts: 2325
Location: Sophia-Antipolis, France
PostPosted: Wed Feb 13, 2008 10:10 am    Post subject: Reply with quote
Modification by megaman worked for me : http://forums.cacti.net/viewtopic.php?p=125940#125940
Back to top
alepot



Joined: 13 Jun 2007
Posts: 1
PostPosted: Wed Feb 13, 2008 8:26 pm    Post subject: Reply with quote
fmangeant wrote:


We're now 3 in this thread having the same issue :
  • SCRIPT_FILENAME => /usr/local/share/cacti/index.php , PHP_SELF => /stats/index.php
  • SCRIPT_FILENAME => /usr/local/share/cacti/index.php , PHP_SELF => /sys_cacti/index.php
  • SCRIPT_FILENAME => /home/cactiuser/test/index.php , PHP_SELF => /foo/index.php


Make that 4, although I had a different solution. My system was 0.8.7a, patched today with the latest patches.

Previouisly, I had always aliased /cacti in apache. Replacing the alias with a symlink in DocumentRoot got it working again.

Is this an Apache issue or a PHP issue?

Alex


Array
(
[HTTP_HOST] => moon
[HTTP_USER_AGENT] => Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.12) Gecko/20080207 Ubuntu/7.10 (gutsy) Firefox/2.0.0.12
[HTTP_ACCEPT] => text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
[HTTP_ACCEPT_LANGUAGE] => en-gb,en;q=0.5
[HTTP_ACCEPT_ENCODING] => gzip,deflate
[HTTP_ACCEPT_CHARSET] => ISO-8859-1,utf-8;q=0.7,*;q=0.7
[HTTP_KEEP_ALIVE] => 300
[HTTP_CONNECTION] => keep-alive
[PATH] => /usr/local/bin:/usr/bin:/bin
[SERVER_SIGNATURE] =>
Apache Server at moon.apcuk.dyndns.org Port 80


[SERVER_SOFTWARE] => Apache
[SERVER_NAME] => moon.apcuk.dyndns.org
[SERVER_ADDR] => 192.168.2.1
[SERVER_PORT] => 80
[REMOTE_ADDR] => 192.168.200.5
[DOCUMENT_ROOT] => /var/www/htdocs
[SERVER_ADMIN] => webmaster@ap-consulting.co.uk
[SCRIPT_FILENAME] => /usr/share/cacti-0.8.7a/index.php
[REMOTE_PORT] => 51294
[GATEWAY_INTERFACE] => CGI/1.1
[SERVER_PROTOCOL] => HTTP/1.1
[REQUEST_METHOD] => GET
[QUERY_STRING] =>
[REQUEST_URI] => /cacti/
[SCRIPT_NAME] => /cacti/index.php
[PHP_SELF] => /cacti/index.php
[REQUEST_TIME] => 1202950839
[argv] => Array
(
)

[argc] => 0
)

Invalid PHP_SELF Path
Back to top
Display posts from previous:   
Post new topic   Reply to topic    Cacti Forum Index -> Help: Linux/Unix Specific All times are GMT - 5 Hours
Goto page 1, 2, 3, 4  Next
Page 1 of 4

 



Powered by phpBB © 2001, 2005 phpBB Group