Nov 27

remove server info and PHP info from response header

Below is a comm http response header:

HTTP/1.1 200 OK
Date: Wed, 27 Nov 2013 01:18:27 GMT
Server: Apache/2.0.55 (Debian) PHP/5.1.2
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Encoding: gzip
Vary: Accept-Encoding
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=utf-8

To keep your server from attack, you should hide all unnecessary information about your system.With apache web server,this was control by ServerTokens  and ServerSignature config directive.From apache manual,we find out  all available config value of ServerTokens and its sample out.

ServerTokens Prod[uctOnly]
Server sends (e.g.): Server: Apache
ServerTokens Major
Server sends (e.g.): Server: Apache/2
ServerTokens Minor
Server sends (e.g.): Server: Apache/2.0
ServerTokens Min[imal]
Server sends (e.g.): Server: Apache/2.0.41
ServerTokens OS
Server sends (e.g.): Server: Apache/2.0.41 (Unix)
ServerTokens Full (or not specified)
Server sends (e.g.): Server: Apache/2.0.41 (Unix) PHP/4.2.2 MyMod/1.2

Obviously, we should turn our config to ServerTokens Prod.

To stop apache from exposing info in related error page,we need to turn off ServerSignature.

ServerSignature off

To hide the php related information,locate your php config file, find or add expose_php.

expose_php off

Nov 17

linux – how to replace special string in multiple files

As an administrator, you will need to fix an error for all user.I found that there are some users use [NC] flag with -f,-d,-l in their RewriteCond directive in zen cart .htaccess file. This misconfiguration is not so critical but it will force the busy server stop  to write to disk and generate huge big error log.i can not just sent a  notice to all the related customers about fixing their error.you know the customer is the god.

i don’t want to correct all the .htaccess file one by one.So,first i need to locate all the file contain
RewriteCond %{REQUEST_FILENAME} !-f [NC]

The command below will list all the .htaccess file containing ‘!-f [NC]‘ from all users’ document root.
# grep -ril ‘\!-f \[NC\]‘ /home/*/www/.htaccess

Now,with the single command below, i will replace all ‘!-f [NC]‘ with ‘!-f‘ in all related .htaccess files found.
#sed -i ‘s/\!-f \[NC\]/\!-f/g’ `grep -ril ‘\!-f \[NC\]‘ /home/*/www/.htaccess`

 

Nov 16

Apache – RewriteCond: NoCase option for non-regex pattern xx is not supported

we got lots of ‘NoCase option not supported’ warning like below from our apache server error log

[Fri Nov 15 20:46:14 2013] [warn] RewriteCond: NoCase option for non-regex pattern ‘-f’ is not supported and will be ignored.

As you may have guessed the problem is with your rewrite rule and one or more lines RewriteCond in your .htaccess file. From the mod_rewrite documentation,i found this

‘nocase|NC’ (no case)
This makes the test case-insensitive – differences between ‘A-Z’ and ‘a-z’ are ignored, both in the expanded TestString and the CondPattern. This flag is effective only for comparisons between TestString and CondPattern. It has no effect on filesystem and subrequest checks.

Pay attention to the last sentence It has no effect on filesystem and subrequest checks. this means that ‘nocase|NC’  is no need when you use ‘-d’ (directory) ‘-f’ (regular file) and ‘-l’ (symbolic link)  in your code pattern in the RewriteCond directive. they will just be ignored.

Unfortunately it is not explicitely written but these CondPatterns will only work in case sensitive mode when it contains filesystem related flags(-d,-f,-l).so keep in minds that you can not test insensitive mode in linux server.This means

If there is a file name A.php in domain(abcdomain.com) root it can be reached via http://www.abcdomain.com/A.php but not http://www.abcdomain.com/a.php

Someone may find that the warning messages still showing up that the waring show up in the error log file after the removed the NC flag.i thought it was because the error log was global error log,so the warning messages will continue showing up before you fix all website on the server.

 

 

Oct 23

whm/cpanel – SoftException in Application.cpp: Directory / is not owned by

in a sudden,all website throw out “500 internal server error”. i got those message from apache error log:

[Tue Oct 22 16:28:27 2013] [error] [client 95.108.217.252] SoftException in Application.cpp:592: Directory / is not owned by falc0961
[Tue Oct 22 16:28:27 2013] [error] [client 95.108.217.252] Premature end of script headers: index.php

Yes, the php is runnning in su_php mode. so this maybe caused by permission.i got no clue after i check the doc root of the related website. the owner and permission is ok.

At last i put my attention on the error log

—- SoftException in Application.cpp:592: Directory / is not owned by falc0961.

i don’t know why it check the root directory.but when i found out that the root is belong to some user id other than root user.so i fix the problem with the simple chown command as:

chown root.root /

(it was casued by copying some directory content to root directory,which overwrite the . file.)

 

Oct 19

apache — 301 redirect from long domain www.abcdomain.com to short abcdomain.com

For search engine, www.abcdomain.com and abcdomain.com are different domain.For seo purpose,we need to do 301 redirect to tell search engine to  treat the two domain as one.

To redirect long form domain with www to the domain without www,you can use the rewrite rule below.this can help you save time if you have lots of websites.

RewriteCond %{HTTP_HOST} ^([a-z0-9-]+)\.([a-z]+)$
RewriteRule (.*) http://www\.%1\.%2/$1 [R=301,L]

OR

RewriteCond %{HTTP_HOST} ^([a-z0-9-]+)\.([a-z]+)$
RewriteRule (.*) http://www\.{HTTP_HOST} [R=301,L]

On the other way,if you prefer to keep short form domain,you can adapt the rule to:

RewriteCond %{HTTP_HOST} ^www.([a-z0-9-]+)\.([a-z]+)$
RewriteRule (.*) http://%1\.%2/$1 [R=301,L]

Oct 17

linux — forward user email

To forward user’s email,just put an .forward file with the email addr in the user’s home diretory.If this not work for your server,Make sure the .forward file is belong to the user you want to forward email.for example,if you want to forward all email for user testuser, change current working directory to /home/testuser,touch a .forward file.

# cd /home/testuser
# touch .forward
# echo ‘abctest@abc.com’ >> .forward
# chown testuser.testuser .forward
# chmod 664 .forward

if this not work,you may check the log file located at /var/log/maillog for more info.

And keep in mind,only in a Postfix/Sendmail system it is sendmail command that utilies this file.For other situation,you may check the related document.

 

Aug 07

apache — Apache is running a threaded MPM, but your PHP Module is not compiled to be threadsafe.

This afternoon,i was trying to install zen cart v1.5.1.The zen cart installer shows that my running php is of version 5.2.6. To continue the installer, the minimum version of php should be 5.2.14.

Unlucky,i didn’t find any php addons which meets zen cart 1.5.1 version. The newest php version wamp support is 5.2.11  which means i will have to grab a new php developing platform(kit).that’s no good.it takes too much time and too much work need to be done. i decided to integrate php5.2.17 to wamp.

At the first time,i download  php-5.2.17-nts-Win32-VC6-x86.zip (VC6 x86 Non Thread Safe) from http://windows.php.net/downloads/releases/php-5.2.17-nts-Win32-VC6-x86.zip.After some setting tweaks,i restart the apache,it shows the error:

Apache is running a threaded MPM, but your PHP Module is not compiled to be threadsafe. You need to recompile PHP.
Pre-configuration failed.

Then i noticed the nts from the file name of the downloaded zip. To fix the problem,i need to download a Thread Safe version. i download from http://windows.php.net/downloads/releases/php-5.2.17-Win32-VC6-x86.zip. It works. maybe you can config apache to run in cgi mode.i didn’t try that.

VC6 x86 Thread Safe

http://windows.php.net/downloads/releases/php-5.2.17-Win32-VC6-x86.zip

Jul 06

how to check if php suport jpeg or png

how to check if your php support jpeg or png on your web server? you can create a phpinfo page to check the gd section. or you can run the following command directly in your shell:

# php -r 'print_r(gd_info());'
Array
(
 [GD Version] => bundled (2.0.34 compatible)
 [FreeType Support] =>
 [T1Lib Support] =>
 [GIF Read Support] => 1
 [GIF Create Support] => 1
 [JPEG Support] =>
 [PNG Support] => 1
 [WBMP Support] => 1
 [XPM Support] =>
 [XBM Support] => 1
 [JIS-mapped Japanese Font Support] =>
)
Jun 18

mysql – how to stop infinite loop in mysql trigger

i have met such situation:two triggers on two talbes,which operate on each other,lead to circular dependencies.sometimes it may get mysql query failed:

Can’t update table ‘v9_member’
in stored function/trigger because it is already used by statement which invoked this stored function/trigger.

Source code    
delimiter //
DROP TRIGGER IF EXISTS in_bbs_cms //
CREATE TRIGGER `in_bbs_cms` AFTER INSERT ON `ucenter_members`
FOR EACH ROW BEGIN
	INSERT INTO `ucenter_members` (username, password, email, regip, regdate, random, ucuserid) VALUES(NEW.username, NEW.password, NEW.email, NEW.regip, NEW.regdate, NEW.salt, NEW.uid);
END
//
 
-- FOR NEW RECORD
DROP TRIGGER IF EXISTS in_cms_bbs //
CREATE TRIGGER `in_cms_bbs` AFTER INSERT ON `v9_member`
FOR EACH ROW BEGIN
	INSERT INTO v9_member (username, password, email, regip, regdate, salt) VALUES (NEW.username, NEW.password, NEW.email, NEW.regip, NEW.regdate, NEW.encrypt);
END
//

 

to avoid this problem, we need to make use of mysql global variable as a flag to trigger.

Source code    
delimiter //
DROP TRIGGER IF EXISTS in_bbs_cms //
CREATE TRIGGER `in_bbs_cms` AFTER INSERT ON `ucenter_members`
FOR EACH ROW BEGIN
	IF @TRIGGERED = NULL THEN
		SET @TRIGGERED = TRUE;
		INSERT INTO `ucenter_members` (username, password, email, regip, regdate, random, ucuserid) VALUES(NEW.username, NEW.password, NEW.email, NEW.regip, NEW.regdate, NEW.salt, NEW.uid);
		SET @TRIGGERED = NULL;
	END IF;
END
//
 
-- FOR NEW RECORD
DROP TRIGGER IF EXISTS in_cms_bbs //
CREATE TRIGGER `in_cms_bbs` AFTER INSERT ON `v9_member`
FOR EACH ROW BEGIN
	IF @TRIGGERED = NULL THEN
		SET @TRIGGERED = TRUE;
		INSERT INTO v9_member (username, password, email, regip, regdate, salt) VALUES (NEW.username, NEW.password, NEW.email, NEW.regip, NEW.regdate, NEW.encrypt);
		SET @TRIGGERED = NULL;
	END IF;
END
//

 

May 31

javascript – A simple javascript countdown timer

This is a simple but light weight javascript countdown timer,which can be integrated to your zen cart store by uploading the file to the jscript sub folder of your current zen cart template folder.

I name it as jscript_timer.php, so i can  put some php configure variable to the zen cart admin backend. if you dont’ want,you can rename it to jscript_timer.js.  This countdown timer countdown 4 days and it will start over again.so no bother to admin setting once and once again.(:

Source code    
<?php
$path = '/' . DIR_WS_TEMPLATE . 'jscript/';
$img = $path . 'timer.png';
?>
<script language="javascript" type="text/javascript"><!--
var present;
var future;
var tseconds;
var seconds;
var minutes;
var hours;
var days;
var limit;
limit =4;
// ID=setInterval("countdown();", 1000);
 
function countdown() {
	present = new Date();
	present = present.getTime();
	future = new Date("MAY 27, 2015 11:59:59");
 
	tseconds = (future - present)  / 1000;
 
	days = tseconds /24/60/60;
	days = Math.floor(days);
	odays = days;
	days = days%limit;
	tseconds = tseconds - (odays - days) * 24 * 60 * 60 - (days * 24 * 60 * 60);
 
	hours = tseconds /60/60;
	hours = Math.floor(hours);
	tseconds = tseconds - (hours * 60 * 60);
 
	minutes = tseconds /60;
	minutes = Math.floor(minutes);
	tseconds = tseconds - (minutes * 60);
 
	seconds = tseconds;
	seconds = Math.floor(seconds);
	htmlstr = '<span style="font-weight:bold;font-size:16px">' + days + '</span> days <span style="font-weight:bold;font-size:12px">' +  hours + ':' + minutes + ':' + seconds + '</span>  Left';
	document.getElementById('timerdiv').innerHTML = htmlstr;
	//console.info(days + ' days ' + hours + ' hours ' + minutes + ' minutes ' + seconds + ' seconds');
}
window.onload = function () {
    ID=setInterval("countdown();", 1000);
};
//--></script>

Feel free to adapt it to fit your need!!