Why is allow_url_fopen disabled on the Grid?

Overview

The PHP parameter allow_url_fopen has been disabled in our PHP environment for the Grid.

If enabled, allow_url_fopen allows PHP's file functions to retrieve data from remote locations such as an FTP server or web site, and could lead to code injection vulnerabilities. Typically, these code injection vulnerabilities occur from improper input filtering when passing user-provided data to PHP functions. Disabling this function will help considerably in stopping your site(s) from being compromised, as well as help thwart the unauthorized use of our servers for abusive or malicious purposes.

What you should do

We would highly suggest further researching and examining aspects of your site's code that depend on this functionality. There are many safer methods to accomplish the same desired results without this possible security issue.

• Use a relative path to the file stored locally.
• Using the PHP environment variable $_SERVER['DOCUMENT_ROOT'], which returns the absolute path to the web root directory.
• cURL is another method that could be used. (This method is beyond the scope of this article. For more information, please see: http://php.net/manual/en/book.curl.php.)

If this software was obtained from a third-party, we suggest contacting their developer. These developers can usually be contacted via forums, email or other methods.

Workaround

You can enable 'allow_url_fopen' by editing your php.ini file. The process is very straightforward; it is as simple as including the following line to your own php.ini file at /home/00000/etc/php.ini. If you are just starting to use a custom php.ini file, you may need to also change the memory_limit value.

allow_url_fopen = 1

FAQ

Q: After making this change, my sites no longer work and I get the error "Fatal error: Allowed memory size of 8388608 bytes exhausted..", how do I fix this?

A: Please be sure to also add the following to your php.ini.

memory_limit = 100M
cgi.fix_pathinfo=1