forum.coppermine-gallery.net

Support => cpg1.3.x Support => Older/other versions => cpg1.3 Miscellaneous => Topic started by: nikita on June 13, 2004, 08:10:00 pm

Title: Security Alert! The PHP CGI cannot be accessed directly
Post by: nikita on June 13, 2004, 08:10:00 pm
Hi,

i've recently installed coppermine 1.3 all it's ok i've just one problem when i want to change the langage i've this error :
Quote
Security Alert! The PHP CGI cannot be accessed directly.
This PHP CGI binary was compiled with force-cgi-redirect enabled. This means that a page will only be served up if the REDIRECT_STATUS CGI variable is set, e.g. via an Apache Action directive.
For more information as to why this behaviour exists, see the manual page for CGI security.
For more information about changing this behaviour or re-enabling this webserver, consult the installation file that came with this distribution, or visit the manual page.

I suppose the problem is from the web server  :( i don't think he will change that  :-\\ so is there something i can change in the code to correct this problem ?

Thanks and sorry for mistake in the langage  ;)
Title: Re: Security Alert! The PHP CGI cannot be accessed directly
Post by: Joachim Müller on June 17, 2004, 01:19:08 pm
link?
Title: Re: Security Alert! The PHP CGI cannot be accessed directly
Post by: nikita on June 18, 2004, 11:25:03 am
http://www.smiley-sanctuary.com/coppermine/

thanks  ;D
Title: Re: Security Alert! The PHP CGI cannot be accessed directly
Post by: Joachim Müller on June 20, 2004, 12:37:50 am
http://www.smiley-sanctuary.com/coppermine/?lang=english works as suggested - I can't see any issue with languages. Your gallery appears to be broken somehow anyway - the thumbs at the bottom show red crosses. Fix this first, probably a permission (CHMOD) issue imo.

GauGau
Title: Re: Security Alert! The PHP CGI cannot be accessed directly
Post by: nikita on June 20, 2004, 08:51:09 am
Hi,

thanks for your answer,

Quote
Your gallery appears to be broken somehow anyway
it's normal i just removed picture file from my server (no enough space).

Quote
I can't see any issue with languages
The problem appears when i use the langage list, when i choose a langage (english for example) it's linking to this adress : http://www.smiley-sanctuary.com/cgi-bin/php.cgi?lang=english

 ;)
Title: Re: Security Alert! The PHP CGI cannot be accessed directly
Post by: Casper on June 20, 2004, 02:03:55 pm
it's normal i just removed picture file from my server (no enough space).

It's not normal.  It makes the gallery look bad, and leaves the database full of out of date information.
You should not just delete from the server by ftp, but you should use the delete functions in coppermine, then this will not happen.
Title: Re: Security Alert! The PHP CGI cannot be accessed directly
Post by: Joachim Müller on June 20, 2004, 03:54:21 pm
What do you have in your config for "Target address for the 'See more pictures' link in e-cards"?

GauGau
Title: Re: Security Alert! The PHP CGI cannot be accessed directly
Post by: nikita on June 20, 2004, 10:55:56 pm
Quote
It's not normal.  It makes the gallery look bad, and leaves the database full of out of date information.
You should not just delete from the server by ftp, but you should use the delete functions in coppermine, then this will not happen.
it's just a test gallery the problem was it before  :\'( after i would have solved this problem i will clean my gallery  ;D

Quote
What do you have in your config for "Target address for the 'See more pictures' link in e-cards"?
at first i had http://www.smiley-sanctuary.com/coppermine/ i have tested with http://www.smiley-sanctuary.com/  + http://www.smiley-sanctuary.com/coppermine/?lang=english same problem  :\'(

I agree http://www.smiley-sanctuary.com/coppermine/?lang=english is working but when i select a langage from the list it goes to http://www.smiley-sanctuary.com/cgi-bin/php.cgi?lang=english  ??? ??? ???

thanks again
Title: Re: Security Alert! The PHP CGI cannot be accessed directly
Post by: Joachim Müller on June 21, 2004, 12:43:43 am
check phpinfo (admin tools): what does it say for $_SERVER["SCRIPT_NAME"]?

GauGau
Title: Re: Security Alert! The PHP CGI cannot be accessed directly
Post by: nikita on June 21, 2004, 08:40:55 am
hi,

nothing with $_SERVER["SCRIPT_NAME"] but i've SCRIPT_NAME  : /cgi-bin/php.cgi

is it that you want  ??? ?
Title: Re: Security Alert! The PHP CGI cannot be accessed directly
Post by: Joachim Müller on June 21, 2004, 09:24:17 am
Yes, this means your server is set up improperly. If it yours to administer, change this. If you're webhosted, ask the server admin to change this for you.
If both fail, edit include/init.inc.php and find
Code: [Select]
$PHP_SELF = isset($HTTP_SERVER_VARS['REDIRECT_URL']) ? $HTTP_SERVER_VARS['REDIRECT_URL'] : $HTTP_SERVER_VARS['SCRIPT_NAME'];Replace $HTTP_SERVER_VARS['SCRIPT_NAME'] with a server var that actually exists on your server.

GauGau
Title: Re: Security Alert! The PHP CGI cannot be accessed directly
Post by: nikita on June 21, 2004, 09:31:44 am
thanks, i'm webhosted i'll ask to him if he can change this, if not do you think i can modify something in the script  ???

for example give this king of link to the list : http://www.smiley-sanctuary.com/coppermine/?lang=english

thanks  ;D
Title: Re: Security Alert! The PHP CGI cannot be accessed directly
Post by: Joachim Müller on June 21, 2004, 09:35:29 am
I don't understand, please re-phrase.

GauGau
Title: Re: Security Alert! The PHP CGI cannot be accessed directly
Post by: nikita on June 21, 2004, 09:41:22 am
ok   :P

the problem is when i select a langage in the list it goes to the wrong url, i just want to know if i can modify it and give it this url http://www.smiley-sanctuary.com/coppermine/?lang=english who works  ?

Thanks and sorry for my weird english  :D
Title: Re: Security Alert! The PHP CGI cannot be accessed directly
Post by: Joachim Müller on June 21, 2004, 10:12:26 am
That's what we're trying to do: we're trying to solve your issue with the language selectors. To do so, we need to correct the improper server setup. My last advice was to replace the improperly defined var in
Code: [Select]
$PHP_SELF = isset($HTTP_SERVER_VARS['REDIRECT_URL']) ? $HTTP_SERVER_VARS['REDIRECT_URL'] : $HTTP_SERVER_VARS['SCRIPT_NAME'];. Please do as suggested.

GauGau
Title: Re: Security Alert! The PHP CGI cannot be accessed directly
Post by: nikita on June 21, 2004, 12:24:00 pm
ok done,

- my administer can't modify SCRIPT_NAME : /cgi-bin/php.cgi   :\'(

- but he asked me : what the script want to do when it uses SCRIPT NAME ?
Title: Re: Security Alert! The PHP CGI cannot be accessed directly
Post by: Joachim Müller on June 21, 2004, 02:27:34 pm
Check the phpinfo ( http://yourdomain.tld/your_coppermine_folder/phpinfo.php ) - especially the section "PHP Variables". There should be a server var, like $PHP_SELF, $_SERVER["SCRIPT_URI"], $_SERVER["SCRIPT_URL"]. Check if any of those vars display have something like /your_coppermine_folder/phpinfo.php or http://yourdomain.tld/your_coppermine_folder/phpinfo.php as value and change post back here.

GauGau
Title: Re: Security Alert! The PHP CGI cannot be accessed directly
Post by: nikita on June 21, 2004, 03:29:18 pm
I've something like that :

- PHP_SELF = /phpinfo.php
- _SERVER["SCRIPT_FILENAME"] = /php/s/smileysa/php.cgi


Quote
PHP Variables
Variable Value
PHP_SELF  /phpinfo.php  
_REQUEST["lang"] french
_REQUEST["phpbb2mysql_data"] a:2:{s:11:\"autologinid\";s:0:\"\";s:6:\"userid\";s:1:\"9\";}
_REQUEST["nuke_nuke_cpg_nuke_data"] YTo1OntzOjI6IklEIjtzOjMyOiJkZjRmOGQyYjg2M2NmNjViZDRkZTNhMWM3MzNmMDlhNyI7czoyOiJhbSI7aToxO3M6NDoibGFuZyI7czo2OiJmcmVuY2giO3M6MzoibGl2IjthOjQ6e2k6MDtzOjM6IjE1NSI7aToxO3M6NDoiMjkwMyI7aToyO3M6NDoiMjkwNCI7aTozO3M6NDoiMjc4OCI7fXM6Njoic2VhcmNoIjtzOjEwOiJSYWxhbWFudGlzIjt9
_REQUEST["cpg130_data"] YTo2OntzOjI6IklEIjtzOjMyOiI5NmRlMzQ0OTFhNWQzMzU5NGFjMzY2ZDFjOTlhYzg5YiI7czoyOiJhbSI7aToxO3M6MzoibGl2IjthOjU6e2k6MDtzOjM6IjIyMCI7aToxO3M6MzoiMTg5IjtpOjI7czo0OiIyNTY3IjtpOjM7czozOiIxNzkiO2k6NDtzOjM6IjE4MiI7fXM6Njoic2VhcmNoIjtzOjU6IkhvdXNlIjtzOjM6ImxhcCI7aToxO3M6NDoibGFuZyI7czo2OiJmcmVuY2giO30=
_REQUEST["cpg130_uid"] 1
_REQUEST["cpg130_pass"] edf6f38dec4d68e43d05aaba6a6586bc
_REQUEST["user"] OTphZG1pbjplOTcyMDM1MDA0NGRjMGE1YWQ4N2M0ZTNiOThmNzhjZjoxMDo6MDowOjA6MDo6NDA5Ng==
_REQUEST["admin"] YWRtaW46OTdjMTljOWQxYzU4NDEzYTY5MmI0ODc5MmEwZGNmZDU6
_SERVER["PATH"] /usr/local/bin:/usr/bin:/bin
_SERVER["DOCUMENT_ROOT"] /home/s/smileysa/www
_SERVER["HTTP_ACCEPT"] image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
_SERVER["HTTP_ACCEPT_ENCODING"] gzip, deflate
_SERVER["HTTP_ACCEPT_LANGUAGE"] fr
_SERVER["HTTP_CONNECTION"] Keep-Alive
_SERVER["HTTP_HOST"] www.smiley-sanctuary.com
_SERVER["HTTP_USER_AGENT"] Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
_SERVER["REDIRECT_STATUS"] 200
_SERVER["REDIRECT_URL"] /phpinfo.php
_SERVER["REMOTE_ADDR"] 82.226.155.17
_SERVER["REMOTE_PORT"] 2338
_SERVER["SCRIPT_FILENAME"] /php/s/smileysa/php.cgi
_SERVER["SERVER_ADDR"] 192.168.1.11
_SERVER["SERVER_ADMIN"] tech@webheberg.com
_SERVER["SERVER_NAME"] www.smiley-sanctuary.com
_SERVER["SERVER_PORT"] 80
_SERVER["SERVER_SOFTWARE"] Apache/1.3.29 (Unix) mod_gzip/1.3.26.1a
_SERVER["UNIQUE_ID"] QNbfkcCoAQsAAFSKAjQ
_SERVER["GATEWAY_INTERFACE"] CGI/1.1
_SERVER["SERVER_PROTOCOL"] HTTP/1.1
_SERVER["REQUEST_METHOD"] GET
_SERVER["QUERY_STRING"] no value
_SERVER["REQUEST_URI"] /phpinfo.php
_SERVER["SCRIPT_NAME"] /cgi-bin/php.cgi
_SERVER["PATH_INFO"] /phpinfo.php
_SERVER["PATH_TRANSLATED"] /home/s/smileysa/www/phpinfo.php
_SERVER["PHP_SELF"] /phpinfo.php
Title: Re: Security Alert! The PHP CGI cannot be accessed directly
Post by: hyperion on June 22, 2004, 02:26:07 am
In include/init.inc.php, change $PHP_SELF to:

Code: [Select]
$PHP_SELF = $_SERVER['PHP_SELF'];

@GauGau,

I've noticed that this is the only self variable that the PHP-CGI binaries seem to create. It might be a good idea to put a note for PHP-CGI users in the documentation.
Title: Re: Security Alert! The PHP CGI cannot be accessed directly
Post by: Joachim Müller on June 22, 2004, 08:01:53 am
@Hyperion: OK, please do so.

GauGau
Title: Re: Security Alert! The PHP CGI cannot be accessed directly
Post by: nikita on June 22, 2004, 08:50:35 am
ok i've replaced :

Quote
$PHP_SELF = isset($HTTP_SERVER_VARS['REDIRECT_URL']) ? $HTTP_SERVER_VARS['REDIRECT_URL'] : $HTTP_SERVER_VARS['SCRIPT_NAME'];

by

Quote
$PHP_SELF = $_SERVER['PHP_SELF'] ? $HTTP_SERVER_VARS['REDIRECT_URL'] : $HTTP_SERVER_VARS['SCRIPT_NAME'];

i don't know if i had to keep the ; so i try :

Quote
$PHP_SELF = $_SERVER['PHP_SELF']; ? $HTTP_SERVER_VARS['REDIRECT_URL'] : $HTTP_SERVER_VARS['SCRIPT_NAME'];

i try that too :

Quote
$PHP_SELF = isset($HTTP_SERVER_VARS['PHP_SELF']) ? $HTTP_SERVER_VARS['REDIRECT_URL'] : $HTTP_SERVER_VARS['SCRIPT_NAME'];


and it's the same problem  :\'(

i can ask to my server admin if there is an information you need.
Title: Re: Security Alert! The PHP CGI cannot be accessed directly
Post by: Joachim Müller on June 22, 2004, 10:48:35 am
Try changing
Code: [Select]
$PHP_SELF = isset($HTTP_SERVER_VARS['REDIRECT_URL']) ? $HTTP_SERVER_VARS['REDIRECT_URL'] : $HTTP_SERVER_VARS['SCRIPT_NAME'];to
Code: [Select]
$PHP_SELF = isset($HTTP_SERVER_VARS['REDIRECT_URL']) ? $HTTP_SERVER_VARS['REDIRECT_URL'] : $_SERVER['PHP_SELF'];
GauGau
Title: Re: Security Alert! The PHP CGI cannot be accessed directly
Post by: nikita on June 22, 2004, 11:39:15 am
done, same problem.
Title: Re: Security Alert! The PHP CGI cannot be accessed directly
Post by: hollandy2k on June 24, 2004, 05:49:08 pm
Hello,

I have the same problem withe the language files. When i select another language i get :

Security Alert! The PHP CGI cannot be accessed directly.
This PHP CGI binary was compiled with force-cgi-redirect enabled. This means that a page will only be served up if the REDIRECT_STATUS CGI variable is set, e.g. via an Apache Action directive.
This in on my phpinfo:

_SERVER["PHP_SELF"] /foto/phpinfo.php 

REDIRECT_STATUS 200
REDIRECT_URL /foto/phpinfo.php

Mirjam
Title: Re: Security Alert! The PHP CGI cannot be accessed directly
Post by: Joachim Müller on June 25, 2004, 01:30:33 am
I'm not sure what to advice except playing with the vars in init.inc.php to find one you actually have on your server.

GauGau
Title: Re: Security Alert! The PHP CGI cannot be accessed directly
Post by: cjkline83 on June 26, 2004, 12:44:11 pm
I'm confused as to what exactly to modify.

I've edited init.inc.php to state the following:
Quote
$PHP_SELF = isset($HTTP_SERVER_VARS['REDIRECT_URL']) ? $HTTP_SERVER_VARS['REDIRECT_URL'] : $HTTP_SERVER_VARS['SCRIPT_NAME'];

But its still not working. http://cjkline83.shacknet.nu/cm
Title: Re: Security Alert! The PHP CGI cannot be accessed directly
Post by: Tranz on November 30, 2004, 11:29:49 pm
I ran into the same problem I guess after upgrading PHP on my computer; the installation came with a different php.ini file.

$_SERVER["SCRIPT_NAME"] was pointing to php/php.exe so that broke the language and theme selectors for me.

I eventually fixed it by changing a setting in php.ini. Since not everyone can edit php.ini, this won't be very helpful for everyone, but I'll share it anyway.

It turned out that my new php.ini file commented out
Code: [Select]
; cgi.fix_pathinfo=1
I removed the semi-colon to enable that line and recompiled php and it worked. My selectors worked again.

Also note that I am using Apache, and PHP as cgi.
Title: Re: Security Alert! The PHP CGI cannot be accessed directly
Post by: wilq on December 17, 2004, 08:43:26 pm
Hello
unluckly I become one of those who have got same problem.
I tried suggested solutions but without result.

Did any body move forrward ??

My web is at: www.komsad.com/piotrw (http://www.komsad.com/piotrw) changing them or lang We get Security alert ...
Title: Re: Security Alert! The PHP CGI cannot be accessed directly
Post by: Joachim Müller on December 19, 2004, 06:50:36 am
try contacting your webhost for support (send them the url of this thread as well).

Joachim
Title: Re: Security Alert! The PHP CGI cannot be accessed directly
Post by: drsirius on December 19, 2004, 01:29:41 pm
In include/init.inc.php, change $PHP_SELF to:

Code: [Select]
$PHP_SELF = $_SERVER['PHP_SELF'];

@GauGau,

I've noticed that this is the only self variable that the PHP-CGI binaries seem to create. It might be a good idea to put a note for PHP-CGI users in the documentation.

I had the same problem there my webhost uses the php.cgi
however I did not find this in the documentation and spent some time searching the forum

maybe it would be wise to add a reference for cgi hosted people and keep up the good work  ;)
Title: Re: Security Alert! The PHP CGI cannot be accessed directly
Post by: Wega on September 27, 2005, 11:09:35 pm
I ran into the same problem I guess after upgrading PHP on my computer; the installation came with a different php.ini file.

$_SERVER["SCRIPT_NAME"] was pointing to php/php.exe so that broke the language and theme selectors for me.

I eventually fixed it by changing a setting in php.ini. Since not everyone can edit php.ini, this won't be very helpful for everyone, but I'll share it anyway.

It turned out that my new php.ini file commented out
Code: [Select]
; cgi.fix_pathinfo=1
I removed the semi-colon to enable that line and recompiled php and it worked. My selectors worked again.

Also note that I am using Apache, and PHP as cgi.

I did so, but then I'v got some errorrs on the header of the page
Code: [Select]
Notice: Undefined index: PATH_TRANSLATED in C:\www\coppermine\index.php on line 21

Notice: Undefined offset: -1 in C:\www\coppermine\index.php on line 22

Warning: Cannot modify header information - headers already sent by (output started at C:\www\coppermine\index.php:21) in C:\www\coppermine\themes\igames\theme.php on line 825

Warning: Cannot modify header information - headers already sent by (output started at C:\www\coppermine\index.php:21) in C:\www\coppermine\themes\igames\theme.php on line 826

Warning: Cannot modify header information - headers already sent by (output started at C:\www\coppermine\index.php:21) in C:\www\coppermine\include\functions.inc.php on line 51
I removed those lines (21)
Code: [Select]
// Check if standalone is installed in a portal like phpNuke (added by DJMaze)
$DIR=preg_split("/[\/\\\]/",dirname($_SERVER['PATH_TRANSLATED']));
if ($DIR[count($DIR)-2] == "modules") {
    echo "<html><body><h1>ERROR</h1>You installed the standalone Coppermine into your Nuke portal.<br>".
         "Please download and install a CPG Port: <a href=\"http://sourceforge.net/project/showfiles.php?group_id=89658\">CPG for PostNuke OR CPG for PHPnuke</a></body></html>";
    die();
} // end check
and ewerything works fine now.