<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><font class="Apple-style-span" color="#1517bb" face="'Times New Roman'"><b><i><br></i></b></font></div><div><div>On 2012-05-03, at 2:28 PM, Paul Gevers wrote:</div><br><blockquote type="cite"><div>Well, the biggest part went into 0.8.7something, except for the<br>possibility to configure the limit and the fact that the ini_set was<br>done in global.php instead of the two last scripts. </div></blockquote><div><br></div><div>The part that was left out is the only important part, in regards to this bug...</div><br><blockquote type="cite"><div>Reading from the<br>diffs, there are two scripts left that use ini_set:<br></div></blockquote><div><br></div><div>Which are the same two that I my proposed fix modifies by hand.</div><div><br></div><blockquote type="cite"><div>See my comments above. But even if global.php would set the<br>memory_limit, the issue would still be there wouldn't it? I.e. asking<br>the cacti developers to port the changes in 5617 wouldn't really help<br>anyway.<br></div></blockquote><div><br></div><div>That depends entirely on how it is implemented. It all boils down to: do the individual scripts still call ini_set to change their memory_limit themselves. If so, then we still need to define suhosin.memory_limit. If not, then suhosin won't complain: it only complains when a script tries to increase it's memory limit mid-run.</div><br><blockquote type="cite"><div>By the way, from your proposed solution: the fact that a php script can<br>call (via command line) an other php script while setting the<br>suhosin.memory_limit defeats the purpose of suhosin quite a bit, doesn't<br>it? Seems like a hole in the system.</div></blockquote><br></div><div>That's a whole different argument. Most people don't seem to find the suhosin patch to be particularly useful... It appears to be quite a kludge. Don't know if my fix uses a "hole" per se; I assume that the suhosin devs feel that suhosin is meant only to protect against misbehaving scripts and external attacks. If a user is able to modify the script or call them from the command line, then all bets are off and suhosin is useless anyways.</div><div><br></div><span class="Apple-style-span" style="font-family: 'Times New Roman'; font-size: 12px; ">François Beaulieu</span><span class="Apple-style-span" style="font-family: 'Times New Roman'; font-size: 12px; "><br></span><span class="Apple-style-span" style="font-family: 'Times New Roman'; font-size: 12px; ">Courriel: </span><span class="Apple-style-span" style="font-family: 'Times New Roman'; font-size: 12px; "><a href="mailto:francois.beaulieu@securebyknowledge.com">francois.beaulieu@securebyknowledge.com</a></span><span class="Apple-style-span" style="font-family: 'Times New Roman'; font-size: 12px; "> | Web: </span><span class="Apple-style-span" style="font-family: 'Times New Roman'; font-size: 12px; "><font color="#0000FB"><u><a href="http://www.securebyknowledge.com/">www.securebyknowledge.com</a></u></font></span><span class="Apple-style-span" style="font-family: 'Times New Roman'; font-size: 12px; "> </span></body></html>