allow_url_fopen

Ok I was looking to see why dolphin was not communicating and found out that url was off so I asked my host provider to turn it on following is the response.

Hello Neil,

In our server allow_url_fopen is disabled. If enabled, allow_url_fopen allows PHP's file functions such as file_get_contents() and the include and require statements can retrieve data from remote locations, like an FTP or web site. Programmers frequently forget this and don't do proper input filtering when passing user-provided data to these functions, opening them up to code injection vulnerabilities. A large number of code injection vulnerabilities reported in PHP-based web applications are caused by the combination of enabling allow_url_fopen and bad input filtering.

Instead of this, you can use cURL, as tinyportal is a freebie script.

Some info about using cURL to pick up remote files can be found here:
http://www.codeandcoffee.com/2006/07/how-to-use-curl-with-php/

Some sample code is here:

http://us2.php.net/manual/en/function.fopen.php#55922

We switch off fopen because of lazy coding and customers not updating their scripts, most site hacks are due to a web server being able to use fopen to include remote files.

We had a lot of problems with this with one or two sites being hacked/defaced per day on our network, this upset the site owners and of course caused potential security issues on our servers.

Since we switched this off, these problems completely stopped, our servers became more stable/happy and our customers didn't have their sites hacked anymore.

It is better to use CURL, as a lot of hosts are turning off fopen due to the serious security risks.

Sorry we can't be of more help here but security has to come first, and the stability of our servers is our top priority.


Will Curl sort this problem out for me in Dolphin or would I be wasting my time?

Kind Regards

Quote · 21 Jan 2010

I recall there being a development ticket to use cURL in the latest release of Dolphin, but I do not believe it made the cut into this release. You're only bet would be to see if you are able to enable allow_url_fopen via your .htaccess file, but judging from the stance of your web host, it would seem unlikely that this would work.

BoonEx Certified Host: Zarconia.net - Fully Supported Shared and Dedicated for Dolphin
Quote · 21 Jan 2010

Yeah I have tried it in there already. so does this mean I am screwed with this host?

Quote · 21 Jan 2010

Yeah I have tried it in there already. so does this mean I am screwed with this host?

Possible, but you're best off getting a second opinion.

BoonEx Certified Host: Zarconia.net - Fully Supported Shared and Dedicated for Dolphin
Quote · 21 Jan 2010
 
 
Below is the legacy version of the Boonex site, maintained for Dolphin.Pro 7.x support.
The new Dolphin solution is powered by UNA Community Management System.