CMS Made Simple Forums

Hi,

Wondering about the new check for output buffering.  Is it really necessary to have this enabled in our php configs?  According the the php.ini file:

; Output buffering allows you to send header lines (including cookies) even
; after you send body content, at the price of slowing PHP's output layer a
; bit.  You can enable output buffering during runtime by calling the output
; buffering functions.  You can also enable output buffering for all files by
; setting this directive to On.  If you wish to limit the size of the buffer
; to a certain size - you can use a maximum number of bytes instead of 'On', as
; a value for this directive (e.g., output_buffering=4096).
output_buffering = Off

Also, I used to keep fopen on but recently started keeping it off b/c there are minor security issues with this. I don't think it has affected my CMSMS sites, but can anyone explain why we should have it on as per the install check with ver 1.5*? 

Thanks!


----------------------------------------------

Cms Version: 1.5.1

Installed Modules:

    * CMSMailer: 1.73.14
    * FileManager: 0.4.3
    * MenuManager: 1.5.3
    * ModuleManager: 1.2.1
    * News: 2.9.1
    * nuSOAP: 1.0.1
    * Printing: 0.2.6
    * Search: 1.5.2
    * ThemeManager: 1.0.8
    * TinyMCE: 2.4.10


Config Information:

    * php_memory_limit:
    * process_whole_template: true
    * max_upload_size: 8000000
    * default_upload_permission: 664
    * assume_mod_rewrite: false
    * page_extension:
    * internal_pretty_urls: false
    * use_hierarchy: false


Php Information:

    * phpversion: 5.2.5
    * md5_function: On (True)
    * gd_version: 2
    * tempnam_function: On (True)
    * magic_quotes_runtime: Off (False)
    * memory_limit: 32M
    * max_execution_time: 60
    * safe_mode: Off (False)
    * session_save_path: /tmp/ (1777)


Server Information:

    * Server Api: cgi-fcgi
    * Server Db Type: MySQL (mysql)
    * Server Db Version: 5.0.67


----------------------------------------------

mww wrote: Also, I used to keep fopen on but recently started keeping it off b/c there are minor security issues with this. I don't think it has affected my CMSMS sites, but can anyone explain why we should have it on as per the install check with ver 1.5*? 

I don't understand....
What is the difference between Required settings and Recommended settings?
For me Required is necessary and Recommended is better but NOT necessary....
or not?

Alby

Ok- 

I realize it is just a notice about the recommendations and the recommendations not necessary for cmsms installation.  However, since I can modify the php configs on most of the servers I work with, I try to meet the recommendations - so in my mind, it is necessary.

I also realize that fopen is not too bad as long as the php code using it is well written.  And, I've trusted the CMSMS codebase and plugins since version 1.0.2.

Allow me to be more specific.

Why is the pre install check looking at fopen as a recommended setting when it hasn't done so before?

Why is the pre install check looking at output buffering as a recommended setting when it hasn't done so before?


Thanks!

mww wrote: Why is the pre install check looking at fopen as a recommended setting when it hasn't done so before?

fopen is required for few new operations (for example automatic notice in admin panel of new release of CMSMS)

mww wrote: Why is the pre install check looking at output buffering as a recommended setting when it hasn't done so before?

From 1.5 I merged some recommended setting from 2.0 (with register_globals, ....) for closed more possible to 2.0

Alby

alby wrote:

mww wrote: Why is the pre install check looking at fopen as a recommended setting when it hasn't done so before?

fopen is required for few new operations (for example automatic notice in admin panel of new release of CMSMS)

mww wrote: Why is the pre install check looking at output buffering as a recommended setting when it hasn't done so before?

From 1.5 I merged some recommended setting from 2.0 (with register_globals, ....) for closed more possible to 2.0

Alby

Thanks for the info Alby!