PHP and Apache server not working properly

jon86

Hi.

I am running Apache server 1.3.29 with PHP 4.3.4 on Win98SE.

Whenever I try and run Apache server in command line window, the first thing is says is...

[Sat Feb 07 18:36:16 2004 [warn] (2)No such file or directory: exec() may not be safe
Apache 1.3.29 (Win32) PHP/4.3.4 running...

What's the "no such ..." all about?

Another thing is that when I try and run test.php just containing <? phpinfo(); ?>, IE6 just displays <? phpinfo(); ?> as text!!
When I run it like this (C:\apache\php\php.exe C:\apache\htdocs\test.php) in a command line window, it outputs the HTML in the command line window.

I know PHP is semi-working coz I get the HTML in the command line window.

I tried http://localhost in IE6 and I get the 'You have successfully installed Apache server' screen load up.

Any ideas? It's really annoying me...

Many thanks,
Jon

mogster

Have you checked if the ending .php is valid in httpd.conf?

You must have:
LoadModule php4_module c:/php/sapi/php4apache.dll

and

AddModule mod_php4.c

and under mod.mime_c

AddType application/x-httpd-php .php

knutm :-)

jon86

I just forgot "AddType application/x-httpd-php .php" 🙂

Do you know why...

Whenever I try and run Apache server in command line window, the first thing is says is...

[Sat Feb 07 18:36:16 2004 [warn] (2)No such file or directory: exec() may not be safe
Apache 1.3.29 (Win32) PHP/4.3.4 running...

What's the "no such ..." all about?

Thanks!!
Jon

mogster

Well, I'm only guessing now, but I think it's one of these:

The basedir is not set, so it warns that running exec may be unsafe (evildoers may ../../ themselves out of webdir and into /etc to open shadow or passwd).

Try to set:
open_basedir = /path/to/webdir/

Some dir-value in httpd.conf is unset.

I think it's the first - try to set the value in php.ini.

knutm :-)

jon86

/path/to/webdir ??

What's webdir? Is it just htdocs in C:\Apache ? 😕

Thanks for all your help!

Jon

mogster

Yes, that would probably be it.
The thing is: as an extra precaution, the php open_basedir limits the users of the scripts to the webdir and the subdirs of the webdir.

This is ecpecially important when users you don't know (non-authenticated users) may use the scripts for opening or write files from/to the webserver.

If a hacker found out that a certain file, lets say users.txt, is opened at some time, he might try to override the default var by setting it as a cookie, or GET'ing it.

If you userfile is set this way:
$userfile = "users.txt";

The hacker may then use the url:
http://yorudomain.com/myscript.php?userfile=../../../etc/passwd
or tweak it in another way to get to the passwords.

knutm :-)