Page 1 of 3
4.4.1 beware! Bug
Posted: Tue Nov 08, 2005 2:16 am
by Brent
If you use phpadsnew please read this
http://forum.phpadsnew.com/index.php?showtopic=9493
There is a bug that prevents it from working in 4.4.1
Posted: Wed Nov 09, 2005 7:55 pm
by scott
cool, thanks for the report!
httpd and mysql hanging
Posted: Thu Nov 17, 2005 10:35 am
by faris
Could the phpadsnew problem be responsible for a problem I'm having?
Basically every day for the past day or so I've found an httpd and mysql process together using 100% cpu on my dual processor machine.
This seems to have started after I upgraded to the latest ART php and mysql two weeks go (RH9).
I was going to ask for advice on how to trace the problem - top just shows the processes and pids, and ps doesn't show anything new about the offending processes.
But I know for a fact that one of my users uses phpadsnew.
Faris.
Posted: Thu Nov 17, 2005 1:28 pm
by scott
Can you try disabling phpadsnew for a day? If it happens again you'd know thats not the problem.
Posted: Sat Nov 19, 2005 8:26 am
by breun
Is this bug already fixed in the current php art packages (4.4.1-1.rhfc3)? Or is it safe/advisable to upgrade from 4.4.0-3.rhfc3 which I'm running now.
Posted: Mon Nov 21, 2005 1:07 pm
by faris
Hmm.. Well, I asked the user to get rid of it and they did, and all seems to be well again. So I think it was very likely that it was the culprit.
It doesn't make sense for things to be so difficult to trace though. I hope to God that PSA 8 will see a change and apache will be run as the actual account user instead of just as httpd/apache.
Or is there something very complicated about doing it?
Breun - I'll be upgrading to the 4.4.1-1 shortly on my test machine. I'll let you know if I have any problems.
Faris.
Posted: Mon Nov 21, 2005 3:59 pm
by scott
You can do that with suphp (psa does this with cgi's now), which is handy for at least finding the user with the exploitable scripts faster.
Posted: Mon Nov 21, 2005 4:12 pm
by breun
How can you do what exactly with suphp?
Posted: Tue Nov 22, 2005 8:57 am
by scott
It works just like suexec, php scripts would run as the user rather than as apache.
Posted: Tue Nov 22, 2005 9:36 am
by breun
Ok, so if I'm not running phpAdsNew it should be safe to upgrade to 4.4.1-1 from art?
Posted: Sun Nov 27, 2005 4:38 pm
by breun
Can anyone confirm it's ok to upgrade to 4.4.1-1?
Posted: Sun Nov 27, 2005 10:57 pm
by jamster
ditto. Am keen to apply latest update but if our developers have used this code anywhere and I go ahead and break it then they'll strangle me!
Do I have to wait for php 4.4.2?
Posted: Sun Nov 27, 2005 11:51 pm
by tabacco
The newest version of phpadsnew is compatible with 4.4.1, so just update that and you're set.
Posted: Wed Nov 30, 2005 8:07 am
by jamster
tabacco wrote:The newest version of phpadsnew is compatible with 4.4.1, so just update that and you're set.
As I understand it it's not just phpadsnew but any php script that has this particular coding. We don't run phpadsnew but we do have a large amount of custom code, and I'm not keen on breaking live sites
Anyone got any ideas if the 4.4.1 from Art is still broken (not blaming scott for this by the way, I know it's a php release issue, just wondered if it's been fixed yet).
Posted: Wed Nov 30, 2005 3:10 pm
by scott
Yeah I always worry about that when I make a big update. Thats one reason I've been holding off on the php5 series. I just know that its going to cause all kinds of weird little tertiary apps to break. It happened with the php 4.3 package all over the place and I learned my lesson that time. Maybe its time to create an [atomic-bleeding] channel like the other maintainers do, so those bolder types can test these things out in advance.