Re: [Phpgroupware-users] Register Globals (was ldapmodify.php; data not being submitted)

[Chris Weiss]

>This may be true, but if you don't know what to look for, you can't find the
>answers.  Solutions to know issues need to be documented based on the
>symptoms of the problem or people not in the know wont be able to find them.
>I for one plan to do my part to make this happen.

it's in all the install docs....

>Perhaps it would be worth documenting which files are effected and how people
>could minimize the impact of the potential security issues it may cause.  In
>this case, simply turning register_globals back off after your finished
>modifying user accounts would close the door again.  As long as there isn't
>anything critical elseware that needs it.  If people want to submit details
>to me, I'd be happy to start such a document.

that's the problem, we don't know what files are affected until someone tries it
and goes through trying to figure why things aren't working.  If we knew where 
all
the problems were it would be rather easy to fix.

As far as security issues, in the core of phpgw register_globals isn't required 
and
so there are no security issues.  In the parts that still require it the issues
will depend on how they are using the globals.  The security issues aren't 
because
of register globals, but because using globals makes it easy to create sloppy 
code
that can be "tricked" to doing things you didn't expect.  It's totaly a coding
issue, and is quite possible to code using globals securly.

>
>> 5 The 0.9.16 API supports our GPC variable sanitizer function "get_var"
>> - now it is upto devs to implement it in their apps.
>>

GPC is Get Post Cookies, register_globals makes them directly available in every
script.  Without register globals you have to request the vars out of the proper
HTTP bits.  the new get_var function makes it easy to do this while maintaining 
the
security.

>> 6 phpGW does not run with safe_mode = on which many hosts now use as the
>> default config.  This is something else that will need to be addressed -
>> but unlikely in 0.9.16

I don't think this can ever happen.  phpgw is a HUGE app, and many useful parts
depend on the ability to make TCP connections and create files on the file 
system,
which safe mode disables.  php safe mode is the lazy way to secure a web server.