Web Hosting Talk : Web Hosting Main Forums : Hosting Security and Technology : php.ini include_path issues

[Tom M]

php.ini include_path issues

Hello,
I've installed Drupal quite a few times on different servers but it was the first time on a new server we are working on. Likewise, we installed another CMS application for the first time on this server.
Both Drupal and the other CMS were bringing up errors during installation.
Drupal was displaying:
Code:

Warning: include_once(includes/install.inc) [function.include-once]: failed to open stream: No such file or directory in /home/*****/*****/*****.com/public_html/includes/database.inc on line 129

Warning: include_once() [function.include]: Failed opening 'includes/install.inc' for inclusion (include_path='/usr/local/lib/php') in /home/*****/*****/*****.com/public_html/includes/database.inc on line 129

Fatal error: Call to undefined function install_goto() in /home/*****/*****/*****.com/public_html/includes/database.inc on line 130
The other CMS, errors that were also related to include_path.
After abit of digging around on Drupal's forums I found a thread that had the exact error I was encountering and the problem, the thread starter claimed, was a "misconfiguration" within php.ini. He said that he made the following change and it fixed his problem:
Changing:
Code:

; Windows: "\path1;\path2"
;include_path = ".;c:\php\includes"
include_path = "/usr/local/lib/php"
TO
Code:

; Windows: "\path1;\path2"
;include_path = ".;c:\php\includes"
include_path = ".:/usr/lib/php:/usr/local/lib/php"
Well, after exhausting all other means to remedy this problem I tried it out. It did indeed fix my problem with Drupal and Drupal ran perfectly. It also fixed the problem with the other CMS.
I contacted the management company that we use sometimes just to see what they had to say about the problem and the solution I used:
Quote:


The changes (you have made) are not correct. Include_path should be disabled and Drupal installation directory's permission needs to be changed to 777.



Not understanding this fully they apparently disabled include_path. Drupal still responds, however, the other script (CMS) is now very slow.
I just wanted to ask if the change to include_path within php.ini I made was truly incorrect and why/what they have actually disabled?
Any help would be appreciated!
Thanks,
Tom





__________________It can only be attributable to human error.

[jem3]

Changing a directory's permissions to 777 is just not secure. It is a bit surprising that a hosting company would tell you to do this!
The adding to the include path cured the problem and avoided the security issue; it seems like the best solution.





__________________
Joyce Miletic RHCT + Systems EngineerNavisite Dedicated Hostinghttp://dedicatedhosting.navisite.com"24/7/365" Myth or Reality? Take the Survey

[koithara]

hei tom,
you needn't have to disable include_path for your drupal installation to work. i don't think thats the right way to do things. and on changing the permission to 777 is not at all advisable. i guess there is some other problem with your server permissions.
why don't you give a "tail -f /usr/local/apache/logs/error_log" from shell as root user while browsing your site. it may shed some light on your actual issue.





__________________Sony Koithara ,CrazyAdmins.com -> where admins go c r @ z y!!!

[steveks]

Is this a cpanel server ? I believe some thing called as OpenBase Dir restrictions which can cause these kind of issues.
Just have a try by disabling it in WHM. Just a try, not 100% sure.





__________________
The man who removes a mountain begins by carrying away small stones.

[koithara]

openbae dir restrictions can be disabled for a particualr domain from whm-> tweak security





__________________Sony Koithara ,CrazyAdmins.com -> where admins go c r @ z y!!!

[steveks]

yes, that i meant before. Tom, have a try and let us know.





__________________
The man who removes a mountain begins by carrying away small stones.

[Tom M]

Hello,
Many thanks for the replies.
I should have stated in the original post, I use DirectAdmin not Cpanel.
I have not been able to locate anything in error logs.
I updated my management ticket with further questions, wondering why after they disabled include_path that one of the CMS's appears to be running very slowly:
Quote:


Either application should stop or it should work if we disable include_path. There is no reason to being slowed.
I have optimized MySQL and Apache it should be Ok now. Include_path should be disabled because PHP finds default path for application itself so there is no need to modify it specially in control panel servers.


Unsure if I should just re-enable include_path and set it as I did originally.





__________________It can only be attributable to human error.






Last edited by Tom M : 10-22-2008 at 01:57 PM.

[jem3]

Hey Tom, only you can make that decision... if it were me, if you can stay within the parameters that they set out and still have a secure site, then I would do that, but if doing it their way results in a blatant vulnerability, then I would argue to go the other way. Are there any downsides to enabling include_path? Does it cause something else to stop working?





__________________
Joyce Miletic RHCT + Systems EngineerNavisite Dedicated Hostinghttp://dedicatedhosting.navisite.com"24/7/365" Myth or Reality? Take the Survey

[macooper]

There shouldn't be any need to use the include_path for this type of problem, but modifying the directories to 777 also seems wrong. Personally, I woud modify the directory permissions to 755 and leave out the include_path setting. The only directories that should need 777 permissions are any directories where users upload images (such as avatars, personal pics for a gallery etc.)





__________________
Martin

[Tom M]

Thanks Jem3 and macooper.
I agree completely on the 777 issue - I'll be changing that back (unsure why they changed it in the first place)
I'll stick with the change they have made for now and try to troubleshoot why it has slowed down the other script.
Thanks for the help.
T.





__________________It can only be attributable to human error.