Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Plugin SecurityInfo shows wrong result for Suhosin Extension #1753

Closed
anonymous-matomo-user opened this issue Oct 5, 2010 · 3 comments
Closed

Plugin SecurityInfo shows wrong result for Suhosin Extension #1753

anonymous-matomo-user opened this issue Oct 5, 2010 · 3 comments
Labels
Bug For errors / faults / flaws / inconsistencies etc.
Milestone
1.1

Comments

@anonymous-matomo-user
Copy link

I'm running Piwik 1.0 with FastCgi on a Debian Lenny system.

The SecurityInfo-Plugin says:

  1. You are not running PHP with the Suhosin extension loaded. We recommend both the patch and extension for low- and high-level protections including transparent cookie encryption and remote inclusion vulnerabilities.

  2. You are not running PHP with the Suhosin patch applied. We recommend both the patch and extension for low- and high-level protections against (for example) buffer overflows and format string vulnerabilities.

The php tells me:
/usr/bin/php5-cgi --version
PHP 5.2.6-1+lenny9 with Suhosin-Patch 0.9.6.2 (cgi-fcgi) (built: Aug 4 2010 05:59:13)
Copyright (c) 1997-2008 The PHP Group
Zend Engine v2.2.0, Copyright (c) 1998-2008 Zend Technologies

Same message when calling phpinfo in the piwik dir.
Keywords: feedback
@robocoder
Copy link
Contributor

Perhaps the web server is using a different php binary?

Try again with this script:

<?php
print_r(get_loaded_extensions()); // this should contain "suhosin" if you have the Suhosin extension
print_r(get_defined_constants()); // this should contain SUHOSIN_PATCH if the Suhosin patch was applied

@anonymous-matomo-user
Copy link
Author

$exts = get_loaded_extensions(); // $exts dont contain "suhosin"

$constants = get_defined_constants(); // $constants[= 1, $constants'SUHOSIN_PATCH' = 0.9.6.2

According to this the opened bug can be closed by 50%. It seems that the extension is not loaded and therefore the notice about the extension is correct.
But the notice about the patch shouldnt be given.

@robocoder
Copy link
Contributor

(In [3237]) fixes #1753, refs #1310 - get_defined_constants(false) is broken prior to php 5.2.11

@anonymous-matomo-user anonymous-matomo-user added this to the Piwik 1.1 milestone Jul 8, 2014
This issue was closed.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Bug For errors / faults / flaws / inconsistencies etc.
Projects
None yet
Milestone
1.1
Development

No branches or pull requests
2 participants
@robocoder @anonymous-matomo-user