changed the instructions for php with win32 + apache. Recommending using sapi

over cgi binary, since cgi binary and apache don't mix well security wise.

1 files changed, 31 insertions, 24 deletions

diff --git a/win32/install.txt b/win32/install.txt
index 8359f6bedc..d2b8418f9d 100644
--- a/win32/install.txt
+++ b/win32/install.txt
@@ -210,40 +210,47 @@ Web server configuration
   newcomer. Please consult the Apache Docs for further
   configuration directives.
 
-  If you unzipped the PHP package to C:\PHP\ as desribed
-  above, you need to insert these lines to your Apache conf
-  file to set up the CGI binary:
-
-   ScriptAlias /php/ "c:/php/"
-   AddType application/x-httpd-php .php
-   Action application/x-httpd-php "/php/php.exe"
-
-  Remember to restart the server, for example,
-   NET STOP APACHE
-  followed by
-   NET START APACHE
-
-  If you would like to use PHP as a module in Apache,
-  you should move php4ts.dll to the windows/system (for Windows 9x/Me)
+  Now that version 4.1 introduces a safer sapi module, we recommend^M
+  that you configure PHP as a module in Apache.^M
+^M
+  To do this, you should move php4ts.dll to the windows/system (for Windows 9x/Me)
   or winnt/system32 (for Windows NT/2000) directory, overwriting any
   older file. Then you should add the following three lines to your Apache
-  conf file:
+  conf file: (swap c:/php/ for your PHP install path)
 
-   LoadModule php4_module c:/php/sapi/php4apache.dll
+   LoadModule php4_module c:/php/sapi/php4apache.dll^M
    AddModule mod_php4.c
    AddType application/x-httpd-php .php
 
-  Remember to restart the server, for example,
+  If you wish to install PHP as a CGI binary, read this first:^M
+^M
+    http://www.cert.org/advisories/CA-1996-11.html^M
+^M
+  and then if you are really sure, insert these lines to your conf file: ^M
+^M
+   ScriptAlias /php/ "c:/php/"^M
+   AddType application/x-httpd-php .php^M
+   Action application/x-httpd-php "/php/php.exe"^M
+^M
+  Note, we consider installing PHP like this suicidal.^M
+^M
+  As a further precaution, we recommend you change the "/php/"^M
+  ScriptAlias to something more random, to prevent the binary being^M
+  called directly, which is a security risk.^M
+^M
+  Remember when you have finished to restart the server, for example,
    NET STOP APACHE
   followed by
    NET START APACHE
 
-  To use the source code highlighting feature, simply create a PHP
-  script file and stick this code in:
-   <?php show_source("original_php_script.php"); ?>
-  Substitute original_php_script.php with the name of the
-  file you wish to show the source of. (This is the only way of
-  doing so).
+  To use the source code highlighting feature, add the following
+  line to your apache httpd.conf file:^M
+^M
+    AddType application/x-httpd-php-source .phps^M
+^M
+  Note, this will only work when you install php as a sapi module.^M
+  If you wish to use this feature with the cgi binary, create a new^M
+  file, and use the show_source("path/to/original_file.php"); function.^M
 
   On Win-Apache all backslashes in a path statement such
   as: "c:\directory\file.ext", must be converted to