[TYPO3] system update - what would you recommend

[Xavier Perseguers]

Hello,

> As an alternative, I made a little script, test_sess_start.php, 
> containing only three lines:
> 
> <?php
> session_start();
> ?>
> 
> This resulted in exactly the same errors:
> 
> *Warning*: session_start() [function.session-start 
> <http://www.cheider.nl/cheider2007/fileadmin/scripts/function.session-start>]: 
> SAFE MODE Restriction in effect. The script whose uid is 1152609 is not 
> allowed to access /var/tmp/ owned by uid 0 in 
> */usr/local/WWW/A/.5c2/p/pels4/htdocs/cheider2007/fileadmin/scripts/test_sess_start.php* 
> on line *2*

The message is clear: in Safe mode, the script should be the owner of 
the directory in order to be able to either run or write from/to a 
directory. uid 0 is Root, which is a normal owner for /var/tmp. Do not 
try to change this!

According to http://ch2.php.net/features.safe-mode, you should declare 
/var/tmp in safe_mode_include_dir. Now, as it is said, safe mode is not 
a good solution to the security problem and personnaly I deactivated it 
completely for TYPO3 because it causes more problems than it solves them.

> It actually seems to be a PHP5.2.6 error, or an Apache error, but it is 
> such a nasty error that the T3 BE doesn't work with it.

As said, you'll have a hard work to let TYPO3 run in safe mode, and much 
more work if you plan to share your TYPO3 sources with many website that 
run under different UID.

You should investigate, whenever possible, other solutions to protect 
your website, such as modsecurity and removing execution right no /tmp 
or any directory accessible trough your scripts. This way nasty scripts 
that may be "uploaded" to your server won't be able to be run. In 
addition, use safe mode only to restrict the list of directories that 
may contain executables but do not enforce UID/GID check.

HTH

-- 
Xavier Perseguers
http://xavier.perseguers.ch/en/tutorials/typo3.html