Security .htaccess and php.ini protection rules / #2112

I think those files should be added to repository and placed in every streber installation.

It's not my intension to add this files in "executable" form, it would by dangerous. I propose just add them as template with txt extension.

In these files there is clause - it's for Apache style Unix like servers. We could add some Windows rules later.

php.ini - usually there is configuration, which allows addd php.ini to any directory and is activ in that directory and their subdirectories, so this php.ini template is just for this kind of placement and will be active for streber only.

I agree - different servers, different configurations, sometimes tighlty bounded with particular provider. I added in many places comments like RTFM ;-) - ask provider, admin, read manual of YOUR configuration.

Danger of giving this files to people who does not know a lot about servers and security is that it could see for them so easy.
But doing even some security enhancements is better, than not doung anything.

Streber installation is really easy and I'm shure there will be some people installing and using streber without admin and without necessary knowledge.

Security "How to's", yes.

Do we have native english persons? My english is not for public documents :-(.

I like the idea although in can understand binder's hestitation. We definitelly need a wiki page on hot to secure streber installations. I read some books on PHP-security but I am not really good with apache and server issues.

Attaching the .htacces file is ok. I am not sure if adding the php.ini file to the release is the right we. We should place a big link to the docu-page and provide a download-link there.

Otherwise some people will complain that installation did not work on there special server (and I don't want to take care of those problems...)

Could you write some documentation on the changes you made in the two files at the description of this item?

Warning: require_once() [function.require-once]: open_basedir restriction in effect. File(/install/../std/common.inc.php) is not within the allowed path(s): (.) in /install/install.php on line 43

Warning: require_once(/install/../std/common.inc.php) [function.require-once]: failed to open stream: Operation not permitted in /install/install.php on line 43

Fatal error: require_once() [function.require]: Failed opening required '/install/../std/common.inc.php' (include_path='.:/:/usr/pear') in /install/install.php on line 43

Try to investigate, which function is not allowed.

It seems, that option:

from php.ini

; open_basedir - Limit the files that can be opened by PHP to the specified directory-tree, including the file itself.
; This directive is NOT affected by whether Safe Mode is turned On or Off.
; http://us3.php.net/manual/en/features.safe-mode.php#ini.open-basedir
open_basedir = .

gives this message.
I try to check if instead "." path "/" path will sufficient for install script.