Urgent: Security Issue with PHP.ini Directive

Hosting Support
1

I hope this message finds you well. I am writing to bring to your attention a potential security risk related to the PHP.ini directive on my hosting account.

Enabling the directive that allows for cross-site scripting (XSS) in the PHP.ini file can expose websites to significant security vulnerabilities. There is no valid reason to enable this directive, and using PHP code that requires it is highly risky.

I kindly request that you review and address this issue promptly to ensure the security and integrity of our website and data.

Thank you for your attention to this matter. I look forward to your prompt response and resolution.

Best regards,

allow_url_include = off
3

Please do not use AI to post.
Whatever you have mentioned is not applicable to free hosting.
There is no PHP.ini and CORS is not allowed on free hosting as well.

Which account?

9 Likes
4

Thanks

5

My Account that I’m using now

6

But in this case, what can I do to avoid XSS attacks without the possibility of changing the file?

7

This?

7 Likes
8

Where do you see this as being enabled? This has always been off, as far as I’m aware (with the most recent response from 9 days ago here):

8 Likes
9

If I create a small PHP file with these contents:

<?php
echo "allow_url_include setting: ".ini_get('allow_url_include')."<br>";

And then open it, I see:

allow_url_include setting: off

So the allow_url_include setting is already set to off. And as far as I know, it has always been that way.

What did you find that made you suspect otherwise? Do you have any code, website or URL that proves that this vulnerability exists?

6 Likes
11

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.