Sylvain Rochet | 26 Mar 20:47 2016
Picon

[PATCH] fix crash when next Apache filter module get an uninitialized len value from suphp_bucket_read

Hi,

Attached patch fix a crash caused by mod suPHP when next Apache filter 
module get an uninitialized len value when calling apr_bucket_read(), 
which is just a macro helper which calls suphp_bucket_read() if suphp is 
enabled.

The harm is probably shared between mod_deflate which doesn't check 
apr_bucket_read() return value and suphp_bucket_read() which doesn't 
sanitize its output, which is always a best practice anyway, the patch 
ensure suphp_bucket_read() returns a 0 len value if something went 
wrong.

Sylvain
#! /bin/sh /usr/share/dpatch/dpatch-run
## 14_TuxFamily-suphp-0.7.2-1-sanity-clean-suphp-bucket-read.dpatch
##
## All lines beginning with `## DP:' are a description of the patch.
## DP: TuxFamily patch to fix segfault when next filter is mod_deflate which
## DP: doesn't check apr_bucket_read() return value

 <at> DPATCH <at> 
diff -Nru a/src/apache2/mod_suphp.c b/src/apache2/mod_suphp.c
--- a/src/apache2/mod_suphp.c	2016-03-25 23:01:50.000000000 +0000
+++ b/src/apache2/mod_suphp.c	2016-03-25 23:02:32.420399971 +0000
 <at>  <at>  -471,6 +471,9  <at>  <at> 
   apr_status_t rv;
   int gotdata = 0;
(Continue reading)

mysql.jorge | 27 Oct 12:44 2015
Picon

Fw: new message

Hey!

 

New message, please read http://ribbonrouge.com/turned.php

 

mysql.jorge <at> decimal.pt

_______________________________________________
suPHP mailing list
suPHP <at> lists.marsching.com
https://lists.marsching.com/mailman/listinfo/suphp
mysql.jorge | 27 Oct 12:43 2015
Picon

Fw: new message

Hey!

 

New message, please read http://vipeqhispania.com/gone.php

 

mysql.jorge <at> decimal.pt

_______________________________________________
suPHP mailing list
suPHP <at> lists.marsching.com
https://lists.marsching.com/mailman/listinfo/suphp
mysql.jorge | 27 Oct 12:44 2015
Picon

Fw: new message

Hey!

 

New message, please read http://westelmmarketing.com/fact.php

 

mysql.jorge <at> decimal.pt

_______________________________________________
suPHP mailing list
suPHP <at> lists.marsching.com
https://lists.marsching.com/mailman/listinfo/suphp
Jorge Bastos | 27 Oct 12:44 2015
Picon

Fw: new message

Hey!

 

New message, please read http://brazilsail.com/promise.php

 

Jorge Bastos

_______________________________________________
suPHP mailing list
suPHP <at> lists.marsching.com
https://lists.marsching.com/mailman/listinfo/suphp
David Biers | 25 Sep 01:01 2015

CentOS 7.x x64 and suPHP UserGroup Directive

Hi All,

I've installed suPHP via source and compiled with the following arguments:

./configure --prefix=/usr --sysconfdir=/etc --with-apr=/bin/apr-1-config --with-apxs=/bin/apxs --with-apache-user=apache --with-setid-mode=paranoid --with-php=/bin/php-cgi --with-logfile=/var/log/httpd/suphp_log --enable-SUPHP_USE_USERGROUP=yes

I'm having a problem where in-that the "suPHP_UserGroup" directive is still not recognized for what ever reason and is preventing apache from starting:

Sep 24 17:55:47 server.domain.com systemd[1]: Starting The Apache HTTP Server...
Sep 24 17:55:47 server.domain.com httpd[46295]: AH00548: NameVirtualHost has no effect and will be removed in the next release /etc/httpd/conf.d/domain.com.conf:5
Sep 24 17:55:47 server.domain.com httpd[46295]: AH00526: Syntax error on line 15 of /etc/httpd/conf.d/domain.com.conf:
Sep 24 17:55:47 server.domain.com httpd[46295]: Invalid command 'suPHP_UserGroup', perhaps misspelled or defined by a module not included in the server configuration

I am unsure of what I am doing wrong as from what I can tell I've configured it from source using "paranoid".  The lines specifying UserGroup inside my vhosts are within a <Directory /path/to/webroot> tag as well.

_______________________________________________
suPHP mailing list
suPHP <at> lists.marsching.com
https://lists.marsching.com/mailman/listinfo/suphp
tim | 19 Aug 21:03 2015

Ip address in log file

I have some php scripts being run and can find them in the suphp log file. What would be handy is knowing which ip address is using that script. Can suphp produce such information? 



Sent from my Samsung device
_______________________________________________
suPHP mailing list
suPHP <at> lists.marsching.com
https://lists.marsching.com/mailman/listinfo/suphp
Jan Tomka | 14 Jul 08:35 2015
Picon

${GROUPNAME} in docroot

Hi all,

I was wondering whether ${GROUPNAME} was supported in the docroot variable.

I'm setting up a staging server environment where 3rd party developers have their own user accounts, but are also in per-website groups. The source code directories have g+s bit set.

Changes I made are the following:

docroot=/home/*
umask=0007
allow_file_group_writeable=true
allow_directory_group_writeable=true

It's all working fine, I was just hoping to be able to use ${GROUPNAME} in the docroot to tighten it a bit, but this doesn't seem to work:

docroot=/home/${GROUPNAME}

I'm getting the 'Script "[..]" resolving to "[..]" not within configured docroot' error. (There's a symbolic link which links within the same /home/* directory.)

When I output group name from the script I'm getting the correct value.

When I change the variable name to a non-existent name, I'm getting suPHP::KeyNotFoundException so the variable name seems to be recognised. Is there a way to work out what the variable's value is?

Cheers,
Jan

Welcome to the suPHP-qhrM8SXbD5JCREYaNQg7v0EOCMrvLtNR@public.gmane.org mailing list! To post to this list, send your message to: suphp-qhrM8SXbD5JCREYaNQg7v0EOCMrvLtNR@public.gmane.org General information about the mailing list is at: https://lists.marsching.com/mailman/listinfo/suphp If you ever want to unsubscribe or change your options (eg, switch to or from digest mode, change your password, etc.), visit your subscription page at: https://lists.marsching.com/mailman/options/suphp/jan%40shopix.com.au You can also make such adjustments via email by sending a message to: suPHP-request-qhrM8SXbD5JCREYaNQg7v0EOCMrvLtNR@public.gmane.org with the word `help' in the subject or body (don't include the quotes), and you will get back a message with instructions. You must know your password to change your options (including changing the password, itself) or to unsubscribe without confirmation. It is: 12px/1.35em arial Normally, Mailman will remind you of your lists.marsching.com mailing list passwords once every month, although you can disable this if you prefer. This reminder will also include instructions on how to unsubscribe or change your account options. There is also a button on your options page that will email your current password to you.

--
Magento Certified Developer · Magento Certified Solution Specialist
Shopix Australia · http://www.shopix.com.au · 1300 551 221
_______________________________________________
suPHP mailing list
suPHP <at> lists.marsching.com
https://lists.marsching.com/mailman/listinfo/suphp
daniel-marschall | 20 Nov 21:35 2014
Picon

suPHP and mail logging

Hello,

I have a problem with suPHP and mail logging.

In php.ini I have following content to detect sending of spam:

mail.log = /var/log/php/mail.log

When I use mail() with one of my users, I get the error message that 
/var/log/php/mail.log is not writeable by the user, which is correct. 
But I expect that this file is written by www-user, since the writing 
process is an internal functionality of PHP's mail() function and cannot 
be exploited by the user in writing arbitary files, so I don't want that 
suPHP enforces the user-privileges to this internal functionality.

I can't use per-user-logfiles since I don't want that users remove 
their own log entries to hide sending spam.

What can I do?

Best regards
Daniel Marschall
Michele Cerioni | 12 Nov 11:54 2014
Picon

chroot

Hi,

I've some  problems to configuring suphp with chroot option.

Using in suphp.conf chroot=/ everythigs is working, while using
chroot=/home/web I have this error on web page:

Internal Server Error
Could not execute script "/usr/local/www/demoprotocol.it/prova/ss.php3"

There aren't any errors about error_log file of apache.

I think the problem is on the chroot enviroment of chroot. I tested this 
with the command

chroot --userspec=517 /home/web /usr/local/apache/php/bin/php-cgi 
/usr/local/www/demoprotocol.it/prova/ss.php3
and works

Could someone help me?
thanks
Michele
Michele Cerioni | 31 Oct 14:49 2014
Picon

chroot

Hi,

I've some  problems to configuring suphp with chroot option.

Using in suphp.conf chroot=/ everythigs is working, while using
chroot=/home/web I have this error on web page:

Internal Server Error
Could not execute script "/usr/local/www/demoprotocol.it/prova/ss.php3"

There aren't any errors about error_log file of apache.

I think the problem is on the chroot enviroment of chroot. I tested this 
with the command

chroot --userspec=517 /home/web /usr/local/apache/php/bin/php-cgi 
/usr/local/www/demoprotocol.it/prova/ss.php3
and works

Could someone help me?
thanks
Michele

Gmane