Bug#674089: Possible release note for systems running PHP through CGI.

2012-08-21 Thread Ondřej Surý
On Mon, Aug 20, 2012 at 8:12 PM, Stefan Fritsch s...@debian.org wrote: On Monday 20 August 2012, Ondřej Surý wrote: Ah, I see; it gets executed when there is no know handler or mime-type for second extension. E.g. index.php.jpeg works as expected (e.g. returning PHP source code),

Bug#674089: Possible release note for systems running PHP through CGI.

2012-08-21 Thread Ondřej Surý
Default PHP extension configuration ^^^ This needs Apache 2, e.g. Default PHP extension configuration for Apache 2. --- The mime-types package has dropped non-standard definitions of PHP MIME-Types as a security measure. Default PHP configuration for

Bug#674089: Possible release note for systems running PHP through CGI.

2012-08-21 Thread Konstantin Khomoutov
On Tue, Aug 21, 2012 at 09:07:59AM +0200, Ondřej Surý wrote: [...] Maybe add just a small paragraph that the configuration of the extensions has changed and php users should read the NEWS file? That's probably sensible approach. I have quickly drafted short paragraph which can be used for

Bug#674089: Possible release note for systems running PHP through CGI.

2012-08-21 Thread Ondřej Surý
On Tue, Aug 21, 2012 at 9:38 AM, Konstantin Khomoutov flatw...@users.sourceforge.net wrote: On Tue, Aug 21, 2012 at 09:07:59AM +0200, Ondřej Surý wrote: [...] Maybe add just a small paragraph that the configuration of the extensions has changed and php users should read the NEWS file?

Bug#674089: Possible release note for systems running PHP through CGI.

2012-08-21 Thread Konstantin Khomoutov
On Tue, 21 Aug 2012 09:48:37 +0200 Ondřej Surý ond...@debian.org wrote: [...] The mime-types package has dropped non-standard definitions of PHP MIME-Types as a security measure. Default PHP configuration for libapache2-mod-php5{filter} and php5-cgi now only serve files which have .php,

Bug#674089: Possible release note for systems running PHP through CGI.

2012-08-21 Thread Philip Hands
Konstantin Khomoutov flatw...@users.sourceforge.net writes: ... Then I suggest it to be rephrased ... extensions on the rightmost place ..., or may be even simpler: ... php5-cgi now only serves files which have .php, .php[345] or .phtml as their rightmost extension how about ... have

Bug#674089: Possible release note for systems running PHP through CGI.

2012-08-21 Thread Christoph Anton Mitterer
On Tue, 2012-08-21 at 09:07 +0200, Ondřej Surý wrote: Maybe add just a small paragraph that the configuration of the extensions has changed and php users should read the NEWS file? That's probably sensible approach. I have quickly drafted short paragraph which can be used for release

Bug#674089: Possible release note for systems running PHP through CGI.

2012-08-20 Thread Ondřej Surý
Hi all, [multiple messages from d-d and d-r merged together] I am also concerned that a *simple* solution to restore the old behaviour in a secure way is not provided: maybe php5-cgi should install a sensible default configuration in /etc/apache2/conf.d/ ? I have prepared new update for PHP

Bug#674089: Possible release note for systems running PHP through CGI.

2012-08-20 Thread Charles Plessy
Le Mon, Aug 20, 2012 at 02:57:10PM +0200, Ondřej Surý a écrit : I have prepared new update for PHP based on comments from d-d. The commit is here: http://anonscm.debian.org/gitweb/?p=pkg-php/php.git;a=commit;h=72eef08994f65b227103509617652d7c0bf0587a Hi Ondřej, many thanks for this work.

Bug#674089: Possible release note for systems running PHP through CGI.

2012-08-20 Thread Ondřej Surý
On Mon, Aug 20, 2012 at 3:35 PM, Charles Plessy ple...@debian.org wrote: Charles, did you test that or you base that claim on Christoph's mails? I have just tested both php5-cgi in standard configuration as recommended in README.Debian and this claim doesn't seem to be true: $ wget -q -O -

Bug#674089: Possible release note for systems running PHP through CGI.

2012-08-20 Thread Stefan Fritsch
On Monday 20 August 2012, Ondřej Surý wrote: Ah, I see; it gets executed when there is no know handler or mime-type for second extension. E.g. index.php.jpeg works as expected (e.g. returning PHP source code), index.php.blubb but gets executed. I don't think there's any harm in disabling

Bug#674089: Possible release note for systems running PHP through CGI.

2012-08-20 Thread Christoph Anton Mitterer
Hi Ondřej. On Mon, 2012-08-20 at 14:57 +0200, Ondřej Surý wrote: http://anonscm.debian.org/gitweb/?p=pkg-php/php.git;a=commit;h=72eef08994f65b227103509617652d7c0bf0587a - You mention in the README.Debian now, that no other webserver likely used /etc/mime.types. Wasn't there someone who meant