Server update/changed causing issues in oscommerce

[t9clkclnr]

I hate to post this thread here, but the oscommerce forums are not user friendly.

Some type of change on my server recently is causing problems with oscommerce installations new and old.

products cannot be added to the shopping carts for all oscommerce installations on my server.
I have some instllations 2 years old, and new ones as recent as an hour prior to this post.

not sure what could be causing this. I compared my php.ini & httpd.conf files with another working server. Can't find anything remotely similiar.

anyone experience anything close or know where to look?

 

[chirpy]

Check /usr/lib/php.ini and make sure that:

register_globals = On

If it's off, change it to On and then restart httpd:

/scripts/restartsrv_httpd

 

[AndyReed]

Is it not a security risk to have register_globals on server-wide?

It is not good idea to switch register_globals on. According to The Php Group, chapter 29,

When on, register_globals will inject your scripts with all sorts of variables, like request variables from HTML forms. This coupled with the fact that PHP doesn't require variable initialization means writing insecure code is that much easier. It was a difficult decision, but the PHP community decided to disable this directive by default. When on, people use variables yet really don't know for sure where they come from and can only assume. Internal variables that are defined in the script itself get mixed up with request data sent by users and disabling register_globals changes this.

Unless the Php code is very well written/coded, there are security risks. On our servers, we switched register_globals OFF, by default.

For more information about register_globals:

- Chapter 29. Using Register Globals
http://us2.php.net/register_globals

- Chapter 62. Miscellaneous Questions
http://us2.php.net/manual/en/faq.misc.php#faq.misc.registerglobals

 

[celliott]

Is it not a security risk to have register_globals on server-wide?

 

[t9clkclnr]

yes it is a security risk, however

I believe oscommerce requires it.
Chirpy, I did check my instances of php.ini and it is set to on.. hush hush, mums the word .

However it did not help with my issue. The cart is still not accepting product. Bizarre. Any other ideas that may help me in this matter?

I seriously doubt it has to do with the oscommerce package. (not certain though).

Are there any apache configs that could cause this?

 

[t9clkclnr]

resolved.

Ok, figured out the problem. For some reason the existing and new installations of osCommerce don't work well with the configure.php file. something globally had changed during an update.

I have to tweak the configure.php file a bit and removed the calls to the global variables and made them static and it worked.

I had to make these changes to 6 e-commerce sites on my server. They all work now.