The directive "allow_url_fopen" is a useful feature of PHP.
For example, xoopsheadline is depends on "allow_url_fopen".
If you turn "allow_url_fopen" off, you can't use xoopsheadline neither as main and nor as block.
But this feature often cause serious vulnerablities in fact.
I think that "allow_url_fopen On" is a setting which should be avoided as much as "register_globals On".
Scripts using snoopy instead of fopen("http://...","r") can work under "allow_url_fopen Off".
Of course, xoopsheadline can also work under "allow_url_fopen Off" if it is modified as using snoopy.
line 62 in xoopsheadline/class/headlinerenderer.php
old:
le="color: #000000"><?php if (!$fp = fopen($this->_hl->getVar('headline_rssurl'), 'r')) { $this->_setErrors('Could not open file: '.$this->_hl->getVar('headline_rssurl')); return false; } $data = ''; while (!feof ($fp)) { $data .= fgets($fp, 4096); } fclose ($fp);
new:
le="color: #000000"><?php // start of snoopy hack $error_level_stored = error_reporting() ; error_reporting( $error_level_stored & ~ E_NOTICE ) ; // includes Snoopy class for remote file access require_once(XOOPS_ROOT_PATH."/class/snoopy.php"); $snoopy = new Snoopy; //TIMEOUT 5 second $snoopy->read_timeout = 5; // timeout on read operations, in seconds //URL fetch if( ! $snoopy->fetch( $this->_hl->getVar( 'headline_rssurl' ) ) || ! $snoopy->results ) { if (!empty($snoopy->error)) { $this->_setErrors('Could not open file: '.$this->_hl->getVar('headline_rssurl')."snoopy status=".$snoopy->error); return false; } else { $this->_setErrors('Could not open file: '.$this->_hl->getVar('headline_rssurl')); return false; } } $data = $snoopy->results ; error_reporting( $error_level_stored ) ; // end of snoopy hack
(thx to hokousya & domifara)
I've released a module named as
XoopsHeadLine-Duplicatable (xhld).
xhld uses snoopy and modified some points from original.
Of course, xhld is a duplicatable module.
Since this module can be worked independently from xoopsheadline, you can try it at ease.
If you've transferred to xhld or hacked by yourself, add
le="color: #000000"><?php php_flag allow_url_fopen Off
into .htaccess in XOOPS_ROOT_PATH.
(If you are server's admin, change php.ini and restart httpd)
This modification will make your XOOPS site stronger from attacks.
