Log in

abstractus

Send private message

You must be logged in to send a private message.

Friends

No friends yet.

Activity

  • abstractus
    abstractus added a new discussion topic What happens if I turn off Symlinks? in the group General Discussion
    During the installation of elgg 1.7.1, I encountered an error 500 problem. My hosting provider's helpdesk advised me to remove the symlink option in the .htaccess file: # Follow symbolic linksOptions +FollowSymLinks As symlinks are not...
    • Dave
      Dave

      What can happen if you leave them turned on?

      Description
      Stefan Esser has reported a vulnerability in PHP, which can be exploited by malicious, local users to bypass certain security restrictions.

      The vulnerability is caused due to a race condition in the handling of symlinks and can be exploited to bypass the open_basedir protection mechanism.

      The vulnerability has been reported in PHP4 and PHP5.

      Solution
      Disable the "symlink()" function in php.ini.

    • Cash
      Cash

      PHP's symlink function is independent of whether Apache can follow symbolic links. Elgg does not require symbolic link support from either Apache or PHP. You'll be fine with both turned off if you choose to do that.

    • abstractus
      abstractus

      Thank you guys! 

  • abstractus
    abstractus joined the group General Discussion

Navigation

Contact

info@elgg.org

Security issues should be reported to security@elgg.org!

Legal

©2014 the Elgg Foundation

Elgg is a registered trademark of Thematic Networks.

Cover image by Raül Utrera is used under Creative Commons license.

Icons by Flaticon and FontAwesome.