Serendipity Forums

I just did a test installation of s9y 2.1-beta1. After the installation I first only got an error 500.

The reason is that the default htaccess contains two php_value commands:
php_value session.use_trans_sid 0
php_value register_globals off

It is my understanding that setting php options via .htaccess has long been deprecated. It only works on installations using mod_php, most modern webhosters use either fcgid or fpm to launch php. In those settings apache is unaware of any php-specific commands in htaccess and will throw an error.
The alternative is to use .user.ini, which works independend of the way PHP is launched:
https://secure.php.net/manual/de/config ... r-user.php
(works since php 5.3.0)

If there is a strong need to support .htaccess-based php options (I don't see a reason for it, except maybe if there is a wish to support very ancient PHP versions), a workaround for this issue is to enclose the options in an IfModule-block. That was used sometimes in the transitioning time.

I have not enough experience with that type of server administration. With a bit of research though it seems to me as if those options were completely unnecessary in newer PHP versions – use_trans_sid is by default 0, and register_globals does not exist anymore. I will remove them, and ping Garvin to have a look at that.

https://github.com/s9y/Serendipity/tree ... nclude/tpl also shows that those files did not change much in the last months/years.

Thanks for the report!

Even though I agree that we can remove those settings as they are deprecated, we actually should have some installer logic which should detect the CGI versions and use a different _cgi.tpl file for those versions. I wonder why these might fail, it would be good to properly detect CGI for some of the other settings to be applied properly...?!

Regards,
Garvin

That would be https://github.com/s9y/Serendipity/blob ... c.php#L682 ?

onli wrote:That would be https://github.com/s9y/Serendipity/blob ... c.php#L682 ?

That looks spot on

In this specific example it might be fpm-fcgi that is missing there. Or it could be a number of different values, sadly… We maybe should adapt the example code with if (substr($sapi_type, 0, 3) == 'cgi') {