|
|
| Author |
Message |
chronos
Joined: 12 Feb 2008
Posts: 5
|
 Posted: Tue Feb 12, 2008 1:11 pm Post subject: Upgrade from 0.8.7a to 0.8.7b: 'Invalid PHP_SELF Path' |
 |
|
On my FreeBSD server, I've updated through the ports system from 8.7a to 8.7b and now I get the following message:
Invalid PHP_SELF Path
I also tried going to /install/index.html but it gives the same message.
This is my config.php file:
$database_type = "mysql";
$database_default = "cacti";
$database_hostname = "localhost";
$database_username = "somethingi";
$database_password = "something";
$database_port = "3306";
Thanks for helping! |
|
| Back to top |
|
 |
fmangeant
Cacti Guru User
Joined: 19 Sep 2003
Posts: 2325
Location: Sophia-Antipolis, France
|
| Posted: Tue Feb 12, 2008 2:23 pm Post subject: |
|
|
Hi
I had the same error when "beta testing" 0.8.7b, but it was fixed.
Can you add this to include/global.php before the "Sanity Check on 'Corrupt' PHP_SELF" block :
| Code: | print "<pre>";
print_r($_SERVER);
print "</pre>"; |
and post the result ? |
|
| Back to top |
|
|
megaman
Joined: 11 Feb 2006
Posts: 3
|
| Posted: Tue Feb 12, 2008 5:36 pm Post subject: |
|
|
I am using FreeBSD too.
Here is the result after adding your code :
| Code: |
Array
(
[DOCUMENT_ROOT] => /usr/local/www/data
[HTTP_ACCEPT] => text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
[HTTP_ACCEPT_CHARSET] => iso-8859-1, utf-8, utf-16, *;q=0.1
[HTTP_ACCEPT_ENCODING] => deflate, gzip, x-gzip, identity, *;q=0
[HTTP_ACCEPT_LANGUAGE] => fr,en;q=0.9,ja;q=0.8,de;q=0.7,es;q=0.6,it;q=0.5,nl;q=0.4,sv;q=0.3,nb;q=0.2
[HTTP_CACHE_CONTROL] => no-cache
[HTTP_CONNECTION] => Keep-Alive, TE
[HTTP_TE] => deflate, gzip, chunked, identity, trailers
[PATH] => /sbin:/bin:/usr/sbin:/usr/bin:/usr/games:/usr/local/sbin:/usr/local/bin:/usr/X11R6/bin:/root/bin
[REMOTE_ADDR] => 192.168.0.254
[REMOTE_PORT] => 57188
[SCRIPT_FILENAME] => /usr/local/share/cacti/index.php
[SERVER_ADDR] => 192.168.0.1
[SERVER_ADMIN] => you@your.address
[SERVER_PORT] => 80
[SERVER_SIGNATURE] =>
[SERVER_SOFTWARE] => Apache
[GATEWAY_INTERFACE] => CGI/1.1
[SERVER_PROTOCOL] => HTTP/1.1
[REQUEST_METHOD] => GET
[QUERY_STRING] =>
[REQUEST_URI] => /stats/index.php
[SCRIPT_NAME] => /stats/index.php
[PATH_TRANSLATED] => /usr/local/share/cacti/index.php
[PHP_SELF] => /stats/index.php
[REQUEST_TIME] => 1202855203
[argv] => Array
(
)
[argc] => 0
)
|
(I removed some variables about cookies and email address)
edit:
after looking to the code, I think it is a problem linked with the aliases' configuration of apache
mine is "alias /stats/ /usr/local/share/cacti/", and the tests done in global.php cant rebuild this path (or validate it) |
|
| Back to top |
|
|
megaman
Joined: 11 Feb 2006
Posts: 3
|
| Posted: Tue Feb 12, 2008 5:52 pm Post subject: |
|
|
A temporary solution would be to edit global.php like that :
comment this line:
| Code: |
if (!((is_file($_SERVER["SCRIPT_FILENAME"])) && (substr_count($_SERVER["SCRIPT_FILENAME"], $_SERVER["PHP_SELF"])))) {
|
add just under it:
| Code: |
if (!((is_file($_SERVER["SCRIPT_FILENAME"])))) {
|
but I dont know if this is secure or not, at least cacti is working again |
|
| Back to top |
|
|
ben_c
Cacti User
Joined: 14 May 2007
Posts: 177
Location: Melbourne, Australia.
|
| Posted: Tue Feb 12, 2008 8:02 pm Post subject: |
|
|
| Hm, I might hold off on applying those patches for .7b based on this thread! |
|
| Back to top |
|
|
chronos
Joined: 12 Feb 2008
Posts: 5
|
| Posted: Tue Feb 12, 2008 9:28 pm Post subject: |
|
|
| megaman wrote: | A temporary solution would be to edit global.php like that :
comment this line:
| Code: |
if (!((is_file($_SERVER["SCRIPT_FILENAME"])) && (substr_count($_SERVER["SCRIPT_FILENAME"], $_SERVER["PHP_SELF"])))) {
|
add just under it:
| Code: |
if (!((is_file($_SERVER["SCRIPT_FILENAME"])))) {
|
but I dont know if this is secure or not, at least cacti is working again |
This does indeed work, but I hate modifying the code in that way to make things work. I hope they release a 0.8.7c version that really fixes the issue.
Thanks! |
|
| Back to top |
|
|
davebassjunkie
Joined: 19 Nov 2007
Posts: 13
|
| Posted: Tue Feb 12, 2008 11:44 pm Post subject: |
|
|
I'm getting the same error from applying the patch for 0.8.7a (multiple_vulnerabilities-0.8.7a.patch)
I'm not going to remove that line from the code, as that stops one of the XSS attacks that are the problem.
I have in my httpd.conf file in regards to the alias:
Alias /cacti "/local/cacti/"
Has anyone found a workaround that does not require removing an alias or taking out the security part? |
|
| Back to top |
|
|
fmangeant
Cacti Guru User
Joined: 19 Sep 2003
Posts: 2325
Location: Sophia-Antipolis, France
|
| Posted: Wed Feb 13, 2008 3:07 am Post subject: |
|
|
I've sent a PM to Larry about this error, which was supposed to be corrected in final release of 0.8.7b
(and I also renamed the first post) |
|
| Back to top |
|
|
Gamb
Joined: 22 Nov 2007
Posts: 11
Location: France
|
| Posted: Wed Feb 13, 2008 4:21 am Post subject: |
|
|
Hello,
I have same problem with $_SERVER["PHP_SELF"] :
| Code: | | Warning: is_file() [function.is-file]: open_basedir restriction in effect. File(/graph_view.php) is not within the allowed path(s): (/tmp:/usr/bin:/home/www/sessions:/usr/share/pear:/home/www/cacti:/usr/local/spine) in /home/www/cacti-0.8.7b/include/global.php on line 112 |
Just replace this condition :
| Code: | | if ((!is_file($_SERVER["PHP_SELF"])) && (!is_file($config["base_path"] . '/' . $_SERVER["PHP_SELF"]))) { |
With this :
| Code: | | if (!is_file($config["base_path"] . '/' . $_SERVER["PHP_SELF"])) { |
|
|
| Back to top |
|
|
TheWitness
Developer
Joined: 14 May 2002
Posts: 9434
Location: MI, USA
|
| Posted: Wed Feb 13, 2008 6:59 am Post subject: |
|
|
I will send a note to the remainder of the developers. Those experiencing this problem need to post their tech support pages for me. Also, please post an error's you are getting in your Apache log.
In the mean time, apply the workaround. I believe that there may be no one solution to this issue.
Regards,
Larry |
|
| Back to top |
|
|
chronos
Joined: 12 Feb 2008
Posts: 5
|
| Posted: Wed Feb 13, 2008 7:58 am Post subject: |
|
|
Here's my _SERVER array:
Array
(
[UNIQUE_ID] => ss00HMCoAQoAAEZzUy4AAAAJ
[HTTP_HOST] => www.clkroot.net
[HTTP_USER_AGENT] => Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.8.1.12) Gecko/20080201 Firefox/2.0.0.12
[HTTP_ACCEPT] => text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
[HTTP_ACCEPT_LANGUAGE] => en-us,en;q=0.5
[HTTP_ACCEPT_ENCODING] => gzip,deflate
[HTTP_ACCEPT_CHARSET] => ISO-8859-1,utf-8;q=0.7,*;q=0.7
[HTTP_KEEP_ALIVE] => 300
[HTTP_CONNECTION] => keep-alive
[HTTP_COOKIE] => ************
[PATH] => /sbin:/bin:/usr/sbin:/usr/bin
[SERVER_SIGNATURE] =>
[SERVER_SOFTWARE] => Apache/2.2.8 (FreeBSD) mod_ssl/2.2.8 OpenSSL/0.9.8e DAV/2 PHP/5.2.5 with Suhosin-Patch mod_scgi/1.12
[SERVER_NAME] => www.clkroot.net
[SERVER_ADDR] => 192.168.1.10
[SERVER_PORT] => 80
[REMOTE_ADDR] => 81.85.237.5
[DOCUMENT_ROOT] => /usr/local/www/wordpress
[SERVER_ADMIN] => **************
[SCRIPT_FILENAME] => /usr/local/share/cacti/index.php
[REMOTE_PORT] => 53845
[GATEWAY_INTERFACE] => CGI/1.1
[SERVER_PROTOCOL] => HTTP/1.1
[REQUEST_METHOD] => GET
[QUERY_STRING] =>
[REQUEST_URI] => /sys_cacti/
[SCRIPT_NAME] => /sys_cacti/index.php
[PHP_SELF] => /sys_cacti/index.php
[REQUEST_TIME] => 1202907375
)
And my alias in my httpd.conf:
Alias /sys_cacti/ "/usr/local/share/cacti/" |
|
| Back to top |
|
|
fmangeant
Cacti Guru User
Joined: 19 Sep 2003
Posts: 2325
Location: Sophia-Antipolis, France
|
| Posted: Wed Feb 13, 2008 8:38 am Post subject: |
|
|
I can reproduice the problem by installing Cacti 0.8.7b in /home/cactiuser/test, with an Apache directory /foo :
| Quote: | | Invalid PHP_SELF Path |
It seems that if the Apache directory name is not included in the directory's name where Cacti is installed, the substr_count($_SERVER["SCRIPT_FILENAME"], $_SERVER["PHP_SELF"]) function will fail.
We're now 3 in this thread having the same issue :
- SCRIPT_FILENAME => /usr/local/share/cacti/index.php , PHP_SELF => /stats/index.php
- SCRIPT_FILENAME => /usr/local/share/cacti/index.php , PHP_SELF => /sys_cacti/index.php
- SCRIPT_FILENAME => /home/cactiuser/test/index.php , PHP_SELF => /foo/index.php
|
|
| Back to top |
|
|
dvl
Joined: 15 Nov 2006
Posts: 12
Location: Warrington, PA
|
| Posted: Wed Feb 13, 2008 10:08 am Post subject: Broken on FreeBSD too... |
|
|
| Gamb wrote: |
Just replace this condition :
| Code: | | if ((!is_file($_SERVER["PHP_SELF"])) && (!is_file($config["base_path"] . '/' . $_SERVER["PHP_SELF"]))) { |
With this :
| Code: | | if (!is_file($config["base_path"] . '/' . $_SERVER["PHP_SELF"])) { |
|
That fix does not work for me. Some part below have been edited.
(
[DOCUMENT_ROOT] => /usr/websites/default/www
[HTTP_ACCEPT] => text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
[HTTP_ACCEPT_CHARSET] => iso-8859-1, utf-8, utf-16, *;q=0.1
[HTTP_ACCEPT_ENCODING] => deflate, gzip, x-gzip, identity, *;q=0
[HTTP_ACCEPT_LANGUAGE] => en-US,en;q=0.9
[HTTP_CACHE_CONTROL] => no-cache
[HTTP_CONNECTION] => Keep-Alive, TE
[HTTP_COOKIE] => PHPSESSID=*removed*; clickedFoldert2=1%5E; highlightedTreeviewLinkt2=2
[HTTP_COOKIE2] => $Version=1
[HTTP_HOST] => *removed*
[HTTP_TE] => deflate, gzip, chunked, identity, trailers
[HTTP_USER_AGENT] => Opera/9.25 (X11; FreeBSD 6 i386; U; en)
[PATH] => /sbin:/bin:/usr/sbin:/usr/bin:/usr/games:/usr/local/sbin:/usr/local/bin:/usr/X11R6/bin:/home/dan/bin
[REDIRECT_STATUS] => 200
[REDIRECT_UNIQUE_ID] => R7MHY0CTcSoAAWjNdz4
[REDIRECT_URL] => /cacti/
[REMOTE_ADDR] => 72.*removed*
[REMOTE_PORT] => 56795
[SCRIPT_FILENAME] => /usr/local/share/cacti//index.php
[SERVER_ADDR] => 64.*removed*
[SERVER_ADMIN] => dan@example.org
[SERVER_NAME] => 127.0.0.1
[SERVER_PORT] => 80
[SERVER_SIGNATURE] =>
[SERVER_SOFTWARE] => Apache
[UNIQUE_ID] => R7MHY0CTcSoAAWjNdz4
[GATEWAY_INTERFACE] => CGI/1.1
[SERVER_PROTOCOL] => HTTP/1.1
[REQUEST_METHOD] => GET
[QUERY_STRING] =>
[REQUEST_URI] => /cacti/
[SCRIPT_NAME] => /cacti/index.php
[PATH_TRANSLATED] => /usr/local/share/cacti//index.php
[PHP_SELF] => /cacti/index.php
[REQUEST_TIME] => 1202915171
[argv] => Array
(
)
[argc] => 0
) |
|
| Back to top |
|
|
fmangeant
Cacti Guru User
Joined: 19 Sep 2003
Posts: 2325
Location: Sophia-Antipolis, France
|
|
| Back to top |
|
|
alepot
Joined: 13 Jun 2007
Posts: 1
|
| Posted: Wed Feb 13, 2008 8:26 pm Post subject: |
|
|
| fmangeant wrote: |
We're now 3 in this thread having the same issue :
- SCRIPT_FILENAME => /usr/local/share/cacti/index.php , PHP_SELF => /stats/index.php
- SCRIPT_FILENAME => /usr/local/share/cacti/index.php , PHP_SELF => /sys_cacti/index.php
- SCRIPT_FILENAME => /home/cactiuser/test/index.php , PHP_SELF => /foo/index.php
|
Make that 4, although I had a different solution. My system was 0.8.7a, patched today with the latest patches.
Previouisly, I had always aliased /cacti in apache. Replacing the alias with a symlink in DocumentRoot got it working again.
Is this an Apache issue or a PHP issue?
Alex
Array
(
[HTTP_HOST] => moon
[HTTP_USER_AGENT] => Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.12) Gecko/20080207 Ubuntu/7.10 (gutsy) Firefox/2.0.0.12
[HTTP_ACCEPT] => text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
[HTTP_ACCEPT_LANGUAGE] => en-gb,en;q=0.5
[HTTP_ACCEPT_ENCODING] => gzip,deflate
[HTTP_ACCEPT_CHARSET] => ISO-8859-1,utf-8;q=0.7,*;q=0.7
[HTTP_KEEP_ALIVE] => 300
[HTTP_CONNECTION] => keep-alive
[PATH] => /usr/local/bin:/usr/bin:/bin
[SERVER_SIGNATURE] =>
Apache Server at moon.apcuk.dyndns.org Port 80
[SERVER_SOFTWARE] => Apache
[SERVER_NAME] => moon.apcuk.dyndns.org
[SERVER_ADDR] => 192.168.2.1
[SERVER_PORT] => 80
[REMOTE_ADDR] => 192.168.200.5
[DOCUMENT_ROOT] => /var/www/htdocs
[SERVER_ADMIN] => webmaster@ap-consulting.co.uk
[SCRIPT_FILENAME] => /usr/share/cacti-0.8.7a/index.php
[REMOTE_PORT] => 51294
[GATEWAY_INTERFACE] => CGI/1.1
[SERVER_PROTOCOL] => HTTP/1.1
[REQUEST_METHOD] => GET
[QUERY_STRING] =>
[REQUEST_URI] => /cacti/
[SCRIPT_NAME] => /cacti/index.php
[PHP_SELF] => /cacti/index.php
[REQUEST_TIME] => 1202950839
[argv] => Array
(
)
[argc] => 0
)
Invalid PHP_SELF Path |
|
| Back to top |
|
|
|
Powered by phpBB © 2001, 2005 phpBB Group
|
|
FAQ
Search
Memberlist
Register
Profile
Log in to check your private messages
Log in
