UBB suhosin Check - UBB.Developers

Title: UBB suhosin Check

Author: Gizmo (James of VNC Web Services)

Requirements: UBB 7.x

Current Version: v0.1

Stock in UBB.Threads 7.5.9

About:
Some hosts with suhosin installed have the value set to the default (512) which can end up with your config.inc.php file set to blank; the below check sits on your admin landing page and displays a warning if this value is below 2048 (as recommended by Mediawiki, so I figure it's a good round number for us as well).

Basically, when we save a page in the CP it will save every value in the CP back to the config file, which can easily go over some configured suhosin values. The below check also will display what the current value is.

We have a writeup at the UBB.Wiki here with more information.

About suhosin:
Suhosin is an advanced protection system for PHP installations. It was designed to protect servers and users from known and unknown flaws in PHP applications and the PHP core. Suhosin comes in two independent parts, that can be used separately or in combination. The first part is a small patch against the PHP core, that implements a few low-level protections against bufferoverflows or format string vulnerabilities and the second part is a powerful PHP extension that implements all the other protections.

Unlike the PHP Hardening-Patch Suhosin is binary compatible to normal PHP installation, which means it is compatible to 3rd party binary extension like ZendOptimizer.

Install Instructions:
In /admin/login.php Find:

Code

if ($ubbt_admin) {
	$ubbt_admin = unserialize($ubbt_admin);
}

Add Below:

Code

// suhosin Check by VNC Web Services (http://www.virtualnightclub.net/)
if(extension_loaded("suhosin") && ini_get("suhosin.get.max_value_length")) {
	if(ini_get("suhosin.get.max_value_length") <= 2048) {
		$suhosin = "You may experience issues with a blank configuration file if you continue, please see <a href=\"http://www.ubbwiki.com/article/view/16/issues-with-suhosin.html\" target=\"_blank\">UBB.Wiki: Issues with suhosin</a>; this issue pertains to the settings of the suhosin module with your webhost.  Your current suhousin length is: ". ini_get("suhosin.get.max_value_length") .".";
	} else {
		$suhosin = "";
	}
}

In /templates/default/admin/login.tmpl Find:

Code

if ($user['USER_MEMBERSHIP_LEVEL'] == "Administrator") {
echo <<<UBBTPRINT
$open  <br />[<a href="{$config['BASE_URL']}/admin/dotoggleopen.php">$dotoggle</a>]
UBBTPRINT;
}

Add Above:

Code

if($suhosin != "") {
echo <<<UBBTPRINT
<span style="color: #CC0000;">$suhosin</span><br /><br />
UBBTPRINT;
}

Wow.. embarrassed to admit that I didn't know what this was. For any one else, here's the short description.

Quote

Suhosin (pronounced 'su-ho-shin') is an advanced protection system for PHP installations. It was designed to protect servers and users from known and unknown flaws in PHP applications and the PHP core. Suhosin comes in two independent parts, that can be used separately or in combination.

So now my next challenge is to figure out how to find out if my Host vendor has it installed.

I expanded on the about section when I got more time (coded while baby was taking a nap, written up while she was eating a snack, lol).

It's generally installed for buffer overflow protection, but is rarely adjusted from the default value of 512, this check reports an error if the value is less than 2048.

Look in your php.ini file

you can use the control panel php info tab on your forums to over see the php info.

Scroll down to the S section and see the suhosin section.

On my set up I had to add

suhosin.post.max_value_length = 2048

into the php.ini file which i located at

/usr/local/lib

on a centos setup.

There were no other suhosin variables listed so it loads the defaults in that case.

Ive not had a problem with the default values but there are plenty of warnings around google if you search that variable so i'm giving it a go.

Description: Default Settings

Description: After line added

Well, the package that's received from their site has the default of 512, 2048 is more than capable for your config (in fact, this script shows a warning of anything below that value).

MOST users are on shared hosts, which means they generally cannot edit this value (and a lot of fly by night hosts just install things vs messing with their default values).

Interesting. I'm on a VPS with Webintellects and supposedly have FULL ACCESS to my virtual server. But there is no suhosin listed in the info section.

Originally Posted by Bill B

Interesting. I'm on a VPS with Webintellects and supposedly have FULL ACCESS to my virtual server. But there is no suhosin listed in the info section.

If the phpinfo doesn't report suhosin then it shouldn't be installed on your server; every php module loaded should indicate itself in one way or another via phpinfo.