Re: Possible release note for systems running PHP through CGI.

2012-08-21 Thread Christoph Anton Mitterer
On Tue, 2012-08-21 at 09:07 +0200, Ondřej Surý wrote: > > Maybe add just a small paragraph that the configuration of the > > extensions has changed and php users should read the NEWS file? > > That's probably sensible approach. I have quickly drafted short > paragraph which can be used for releas

Re: Possible release note for systems running PHP through CGI.

2012-08-21 Thread Konstantin Khomoutov
On Tue, 21 Aug 2012 09:48:37 +0200 Ondřej Surý wrote: [...] > >> The mime-types package has dropped non-standard definitions of > >> PHP MIME-Types as a security measure. Default PHP configuration > >> for libapache2-mod-php5{filter} and php5-cgi now only serve files > >> which have .php, .php[3

Re: Possible release note for systems running PHP through CGI.

2012-08-21 Thread Konstantin Khomoutov
On Tue, Aug 21, 2012 at 09:07:59AM +0200, Ondřej Surý wrote: [...] >> Maybe add just a small paragraph that the configuration of the >> extensions has changed and php users should read the NEWS file? > > That's probably sensible approach. I have quickly drafted short > paragraph which can be use

Re: Possible release note for systems running PHP through CGI.

2012-08-21 Thread Ondřej Surý
On Tue, Aug 21, 2012 at 9:38 AM, Konstantin Khomoutov wrote: > On Tue, Aug 21, 2012 at 09:07:59AM +0200, Ondřej Surý wrote: > > [...] >>> Maybe add just a small paragraph that the configuration of the >>> extensions has changed and php users should read the NEWS file? >> >> That's probably sensibl

Re: Possible release note for systems running PHP through CGI.

2012-08-21 Thread Ondřej Surý
> Default PHP extension configuration ^^^ This needs Apache 2, e.g. Default PHP extension configuration for Apache 2. > --- > > The mime-types package has dropped non-standard definitions of > PHP MIME-Types as a security measure. Default PHP configuration > for

Re: Possible release note for systems running PHP through CGI.

2012-08-21 Thread Ondřej Surý
On Mon, Aug 20, 2012 at 8:12 PM, Stefan Fritsch wrote: > On Monday 20 August 2012, Ondřej Surý wrote: >> Ah, I see; it gets executed when there is no know handler or >> mime-type for second extension. >> >> E.g. index.php.jpeg works as expected (e.g. returning PHP source >> code), index.php.blubb

Re: Possible release note for systems running PHP through CGI.

2012-08-20 Thread Christoph Anton Mitterer
Hi Ondřej. On Mon, 2012-08-20 at 14:57 +0200, Ondřej Surý wrote: > http://anonscm.debian.org/gitweb/?p=pkg-php/php.git;a=commit;h=72eef08994f65b227103509617652d7c0bf0587a - You mention in the README.Debian now, that no other webserver likely used /etc/mime.types. Wasn't there someone who meant li

Re: Possible release note for systems running PHP through CGI.

2012-08-20 Thread Stefan Fritsch
On Monday 20 August 2012, Ondřej Surý wrote: > Ah, I see; it gets executed when there is no know handler or > mime-type for second extension. > > E.g. index.php.jpeg works as expected (e.g. returning PHP source > code), index.php.blubb but gets executed. I don't think there's any > harm in disabli

Re: Possible release note for systems running PHP through CGI.

2012-08-20 Thread Ondřej Surý
On Mon, Aug 20, 2012 at 3:35 PM, Charles Plessy wrote: >> Charles, did you test that or you base that claim on Christoph's >> mails? I have just tested both php5-cgi in standard configuration as >> recommended in README.Debian and this claim doesn't seem to be true: >> >> $ wget -q -O - http://lo

Re: Possible release note for systems running PHP through CGI.

2012-08-20 Thread Charles Plessy
Le Mon, Aug 20, 2012 at 02:57:10PM +0200, Ondřej Surý a écrit : > > I have prepared new update for PHP based on comments from d-d. The > commit is here: > > http://anonscm.debian.org/gitweb/?p=pkg-php/php.git;a=commit;h=72eef08994f65b227103509617652d7c0bf0587a Hi Ondřej, many thanks for this wo

Re: Possible release note for systems running PHP through CGI.

2012-08-20 Thread Ondřej Surý
Hi all, [multiple messages from d-d and d-r merged together] > I am also concerned that a *simple* solution to restore the old > behaviour in a secure way is not provided: maybe php5-cgi should install > a sensible default configuration in /etc/apache2/conf.d/ ? I have prepared new update for PH