Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

setting memory_limit above allowed value results in false attacker identification #10396

Closed
seyfro opened this issue Aug 13, 2016 · 5 comments
Closed
Labels
answered For when a question was asked and we referred to forum or answered it.

Comments

@seyfro
Copy link

seyfro commented Aug 13, 2016

Within the PHP error logs I see a lot of the following alerts :

ALERT - script tried to increase memory_limit to 805306368 bytes which is above the allowed value (attacker 'xx.xx.xx.xx', file '/piwik/core/SettingsServer.php', line 183

It would be great if Piwik would first try to get the allowed memory_limit before trying to set it to 8GB, resulting in unnecessary security alerts.

@tsteur tsteur added the Bug For errors / faults / flaws / inconsistencies etc. label Aug 15, 2016
@tsteur
Copy link
Member

tsteur commented Aug 15, 2016

Good find. Thank you for creating the issue 👍

@mattab
Copy link
Member

mattab commented Aug 16, 2016

Hi @robertharm

it's trying to set the memory to 768M not 8GB. This value comes from the config/global.ini.php file:

; Minimum memory limit enforced when archived via ./console core:archive
minimum_memory_limit_when_archiving = 768

Piwik reads the memory_limit value and will try to set it to at least 768M while archiving, if the current memory limit value is less. If you don't need 768M minimum then you can override in your config/config.ini.php such as:

[General]
minimum_memory_limit_when_archiving=512M

maybe we could create a FAQ but I think this is an edge case so I'm closing the issue for now. cheers

@mattab mattab closed this as completed Aug 16, 2016
@mattab mattab added the answered For when a question was asked and we referred to forum or answered it. label Aug 16, 2016
@tsteur
Copy link
Member

tsteur commented Aug 16, 2016

I think this is a bug. Piwik should not try to allocate more memory than configured in memory_limit if it triggers such warnings. Users might not even be able to change that setting in php ini to avoid such a warning which may be shown to users in the UI. It does increase the value not only during archiving but in general here https://github.com/piwik/piwik/blob/2.16.2/core/SettingsServer.php#L164 . I think any memory limit value should not be configured by default in global ini. By default it should respect the PHP setting and if users for some reasons want to set this setting in config ini, eg because they cannot set the memory limit for their PHP installation, then it should be able to set it as long as it does not generate such warnings

@mattab mattab removed answered For when a question was asked and we referred to forum or answered it. Bug For errors / faults / flaws / inconsistencies etc. labels Aug 17, 2016
@mattab
Copy link
Member

mattab commented Aug 17, 2016

the reason we need this code in Piwik is that, by default many of our users' PHP configuration does not have enough memory allocated (since Piwik archiving is especially memory hungry). the code makes Piwik more user friendly and less likely to fail at random times. We used to have this problem often and people had to change their PHP config which they cannot always easily do.

it's an edge case because this error is only triggered when the Suhosin php extension is used. I think less people are using this extension compared to before. btw just found that WP does a similar thing and they like us have a configurable setting to change the memory limit that WP will try to allocate.

@tsteur
Copy link
Member

tsteur commented Aug 17, 2016

I understand why it's done but it should still not trigger warnings. A solution could be to check whether suhosin is installed etc

@mattab mattab added the answered For when a question was asked and we referred to forum or answered it. label Oct 2, 2016
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
answered For when a question was asked and we referred to forum or answered it.
Projects
None yet
Development

No branches or pull requests

3 participants