phpwiki-talk

[Phpwiki-talk] Secure operation

[Tim B. <tim...@wc...>]

(tap-tap)  "Is this thing on?"

Hello folks.  My name is Tim and this is my first post to this list.  My 
question is, will phpwiki work on Apache-ssl on port 443?  And if so, how 
would I go about setting that up?

Tim

Re: [Phpwiki-talk] Secure operation

[Gary B. <ga...@in...>]

On Tue, 15 Jan 2002, Tim Bogart wrote:

> Hello folks.  My name is Tim and this is my first post to this list.  My 
> question is, will phpwiki work on Apache-ssl on port 443?  And if so, how 
> would I go about setting that up?

It should work straight out of the box, assuming you have the Apache SSL 
server running...

Cheers,
Gary

[ ga...@in... ][ GnuPG 85A8F78B ][ http://inauspicious.org/ ]

Re: [Phpwiki-talk] Secure operation

[<se...@br...>]

On Tue, Jan 15, 2002 at 04:37:36PM +0000, Gary Benson wrote:
> 
> On Tue, 15 Jan 2002, Tim Bogart wrote:
> 
> > Hello folks.  My name is Tim and this is my first post to this list.  My 
> > question is, will phpwiki work on Apache-ssl on port 443?  And if so, how 
> > would I go about setting that up?
> 
> It should work straight out of the box, assuming you have the Apache SSL 
> server running...
> 
> Cheers,
> Gary
> 
> [ ga...@in... ][ GnuPG 85A8F78B ][ http://inauspicious.org/ ]

I'm using phpwiki in a https:// environment now (Apache), but didnt
worked straight out of the box.

I made the following patch to work correctly (phpwiki was
misconstructing the links as http://):

diff -u phpwiki-1.3.2/lib/config.php  /var/www/haxent/wiki/lib/config.php

--- phpwiki-1.3.2/lib/config.php        Mon Dec 17 00:08:58 2001
+++ /var/www/haxent/wiki/lib/config.php Wed Jan  2 10:15:52 2002
@@ -153,7 +153,7 @@
 if (!defined('SERVER_NAME')) define('SERVER_NAME', $HTTP_SERVER_VARS['SERVER_NAME']);
 if (!defined('SERVER_PORT')) define('SERVER_PORT', $HTTP_SERVER_VARS['SERVER_PORT']);
 if (!defined('SERVER_PROTOCOL')) {
-    if (empty($HTTP_SERVER_VARS['HTTPS']) || $HTTP_SERVER_VARS['HTTPS'] == 'off')
+    if ((empty($HTTP_SERVER_VARS['HTTPS']) || $HTTP_SERVER_VARS['HTTPS'] == 'off') && $HTTP_SERVER_VARS['SERVER_PORT'] != '443')
         define('SERVER_PROTOCOL', 'http');
     else
         define('SERVER_PROTOCOL', 'https');

HTTP_SERVER_VARS['HTTPS'] is not getting sane values here, probably,
i dont know why.

Sergio Bruder
--
http://pontobr.org, http://sergio.bruder.net, http://bruder.homeip.net:81
-----------------------------------------------------------------------------
pub  1024D/0C7D9F49 2000-05-26 Sergio Devojno Bruder <se...@br...>
     Key fingerprint = 983F DBDF FB53 FE55 87DF  71CA 6B01 5E44 0C7D 9F49
sub  1024g/138DF93D 2000-05-26

Re: [Phpwiki-talk] Secure operation

[Jeff D. <da...@da...>]

> HTTP_SERVER_VARS['HTTPS'] is not getting sane values here, probably, i
> dont know why.

Hi Sergio,

Thanks for the report.  So that we can fix this right:

Would you make a phpinfo script, and see what value HTTPS is getting?

A phpinfo script is a php script (called say phpinfo.php) which contains
one line:

  <?php phpinfo(); ?>

When you browse this you should get reams of HTML text describing PHP's
configuration, etc...  (Example at http://phpwiki.sf.net/test/phpinfo.php.)
In the section labelled "Apache Environment" (or "PHP Variables") it should
list the values its getting for HTTPS.

If you could look at it both over SSL (https:) and normal (http:) that would
be great.  (Or put your phpinfo script where we can get at it and give use
the URL(s).)

Re: [Phpwiki-talk] Secure operation

[<se...@br...>]

On Tue, Jan 15, 2002 at 09:22:10AM -0800, Jeff Dairiki wrote:
> 
> > HTTP_SERVER_VARS['HTTPS'] is not getting sane values here, probably, i
> > dont know why.
> 
> Hi Sergio,
> Thanks for the report.  So that we can fix this right:
> 
> (...)
>
> If you could look at it both over SSL (https:) and normal (http:) that would
> be great.  (Or put your phpinfo script where we can get at it and give use
> the URL(s).)

 https://haxent.bruder.homeip.net/info.php and
 http://haxent.bruder.homeip.net:81/info.php

 (My ADSL provider filter out port 80)

Sergio Bruder
--
http://pontobr.org, http://sergio.bruder.net, http://bruder.homeip.net:81
-----------------------------------------------------------------------------
pub  1024D/0C7D9F49 2000-05-26 Sergio Devojno Bruder <se...@br...>
     Key fingerprint = 983F DBDF FB53 FE55 87DF  71CA 6B01 5E44 0C7D 9F49
sub  1024g/138DF93D 2000-05-26

Re: [Phpwiki-talk] Secure operation

[Jeff D. <da...@da...>]

 said:
> On Tue, Jan 15, 2002 at 09:22:10AM -0800, Jeff Dairiki wrote:

> https://haxent.bruder.homeip.net/info.php and
> http://haxent.bruder.homeip.net:81/info.php

Thanks!

I guess I don't see any way to detect when https is being used
other than by looking at the port (i.e. your patch).

It seems fishy to me.  Mod_ssl is supposed to set all kinds of environment
variables so that CGI scripts (& PHP scripts) can figure out if they're
being run over a secure connection (and how secure the connection is, if
it's encrypted, etc...)  (See
http://www.modssl.org/docs/2.8/ssl_reference.html#ToC25.)

Any idea why that's not happening in your case?

(I run Apache/1.3.22 mod_ssl/2.8.5 --- pretty much exactly your setup, but I
do get all the SSL environment variables.
https://home.dairiki.org/test/phpinfo.php.)

Re: [Phpwiki-talk] Secure operation

[<se...@br...>]

On Tue, Jan 15, 2002 at 10:27:25AM -0800, Jeff Dairiki wrote:
> I guess I don't see any way to detect when https is being used
> other than by looking at the port (i.e. your patch).
> (...)
> Any idea why that's not happening in your case?

 I'm talking with the Conectiva's security guy about that (Im using
 Conectiva Linux), waiting answers.

Sergio Bruder
--
http://pontobr.org, http://sergio.bruder.net, http://bruder.homeip.net:81
-----------------------------------------------------------------------------
pub  1024D/0C7D9F49 2000-05-26 Sergio Devojno Bruder <se...@br...>
     Key fingerprint = 983F DBDF FB53 FE55 87DF  71CA 6B01 5E44 0C7D 9F49
sub  1024g/138DF93D 2000-05-26

Re: [Phpwiki-talk] Secure operation

[Tim B. <tim...@wc...>]

Thanks Jeff, Sergio and Gary.  Well, that was worth the asking.  I almost 
feel like a contributor. ;-)  Now for the really stupid question.  How do I 
turn this stuff on?  I untarred the tarball.  Read the README's and the 
INSTALL's.  Installed postgresql and ran the psql.sql script.  But I can't 
for the life of me figure out to run it.  It seems as though I should be 
ready.  I've even got my pgpwiki database user made.  I just can't figure out 
how to turn it on.

Go ahead and rib me if you must.  Just keep it all in good fun, okay?

Tim

On Tuesday 15 January 2002 01:27 pm, Jeff Dairiki wrote:
>  said:
> > On Tue, Jan 15, 2002 at 09:22:10AM -0800, Jeff Dairiki wrote:
> >
> > https://haxent.bruder.homeip.net/info.php and
> > http://haxent.bruder.homeip.net:81/info.php
>
> Thanks!
>
> I guess I don't see any way to detect when https is being used
> other than by looking at the port (i.e. your patch).
>
> It seems fishy to me.  Mod_ssl is supposed to set all kinds of environment
> variables so that CGI scripts (& PHP scripts) can figure out if they're
> being run over a secure connection (and how secure the connection is, if
> it's encrypted, etc...)  (See
> http://www.modssl.org/docs/2.8/ssl_reference.html#ToC25.)
>
> Any idea why that's not happening in your case?
>
> (I run Apache/1.3.22 mod_ssl/2.8.5 --- pretty much exactly your setup, but
> I do get all the SSL environment variables.
> https://home.dairiki.org/test/phpinfo.php.)
>
>
>
>
>
>
> _______________________________________________
> Phpwiki-talk mailing list
> Php...@li...
> https://lists.sourceforge.net/lists/listinfo/phpwiki-talk

Re: [Phpwiki-talk] Secure operation

[Gary B. <ga...@in...>]

The reason I originally said it would work out of the box is that I
routinely set $ScriptUrl to be relative. It would fix the problem if the
default setting (calculate $ScriptUrl automagically) were to generate
relative rather than absolute URLs. At first glance (looking at a 1.2
setup) this would be quite simple, although such changes usually have a
tendency to break things quite violently ;)

Anyway, good luck with it,
Gary

[ ga...@in... ][ GnuPG 85A8F78B ][ http://inauspicious.org/ ]

Re: [Phpwiki-talk] Secure operation

[Adam S. <ad...@pe...>]

> The reason I originally said it would work out of the box is that I
> routinely set $ScriptUrl to be relative. It would fix the problem if the
> default setting (calculate $ScriptUrl automagically) were to generate
> relative rather than absolute URLs. At first glance (looking at a 1.2
> setup) this would be quite simple, although such changes usually have a
> tendency to break things quite violently ;)

this is what i was thinking as well, but i refrained from commenting
because i figured there must be an issue i didn't understand :-)

is there any reason that phpwiki shouldn't use relative links for
everything?  it saves a lot of trouble with things like this.

adam.

Re: [Phpwiki-talk] Secure operation

[Jeff D. <da...@da...>]

On 15 Jan 2002 17:10:05 -0800
"Adam Shand" <ad...@pe...> wrote:

> is there any reason that phpwiki shouldn't use relative links for
> everything?  it saves a lot of trouble with things like this.

It's a little problematic when (USE_PATH_INFO is on and) page names
contain '/'.  But the asnwer is "no" there's no reason not to (at least
most of the time).  We used to use relative URLs.  (The PhpWiki wiki uses
relative URLs.)  I'm not sure why we don't anymore. (??).

Re: [Phpwiki-talk] Secure operation

[Carsten K. <car...@ma...>]

There is a problem with base hrefs when virtual_path and data_path are 
different. As a quick fix I set the links to use a full url, it's probably 
not too difficult to fix but I just haven't made the time to look at it 
yet.

For example look at the paths on the alpha server:

data_path:
http://phpwiki.sourceforge.net/alpha
http://phpwiki.sourceforge.net/alpha/phpwiki.css etc.
http://phpwiki.sourceforge.net/alpha/images/
http://phpwiki.sourceforge.net/alpha/theme/

virtual_path:
http://phpwiki.sourceforge.net/alpha/en/
http://phpwiki.sourceforge.net/alpha/de/
http://phpwiki.sourceforge.net/alpha/macosx/

On Tuesday, January 15, 2002, at 08:49  pm, Jeff Dairiki wrote:

> On 15 Jan 2002 17:10:05 -0800
> "Adam Shand" <ad...@pe...> wrote:
>
>> is there any reason that phpwiki shouldn't use relative links for
>> everything?  it saves a lot of trouble with things like this.
>
> It's a little problematic when (USE_PATH_INFO is on and) page names
> contain '/'.  But the asnwer is "no" there's no reason not to (at least
> most of the time).  We used to use relative URLs.  (The PhpWiki wiki uses
> relative URLs.)  I'm not sure why we don't anymore. (??).
>