PHP5 Include statement not working

[#1]

So what do I have to do to make my page work again post your trauma
Page in question is http://www.cronkshaw.com/UrbanSoul/weather.php
what it appears to be complaining about is that it can't see http://www.cronkshaw.plus.com/Weather/HalfHourly/USWeatherReport.data
well I can see it externally, have you got some apache spell wrong? such that I can't see it internally.
Or is it that you have turned off access
URL file-access is disabled in the server configuration,
in which case can we have it turned back on, or can someone please suggest a suitable work-around.
I could always upload the data to the cgi server, but you use to ask us to keep the data off the cgi server.
Is this still the case in this brave new world?
An upset  Ian Mac

[#2]

I had the same problem with includes from the Homepages server into a ccgi PHP script. In my case, I did copy the files to the ccgi and included them there.
I did prefer them on the Homepages server as I had FTP access from anywhere to alter the content.
You can, I believe, use a php.ini files to set the allow_url_includes to be on so that there you  can include from an http://...... address, but thewre are security implications for this being misused, and so it has been defaulted to off.
You will need to include a full php.ini which contains all of the settings, not just the allow_url_includes one.
I was talked through the procedure by Gabe. He was most helpful and provided the whole php.ini to use - it might be better to approach him for the details as I'm OK at PHP scripting, but not with the environment.
As it was, I did not, in the end, alter the allow_url_includes entry as it was easier to house the content on the ccgi server.
Hope that the above helps.
Tony

[#3]

Quote from: Alden

URL file-access is disabled in the server configuration, in which case can we have it turned back on, or can someone please suggest a suitable work-around.

A workaround would be to use curl and sanitize, but perhaps your quickest fix would be to move the content to the cgi server, as Tony suggests.

Quote

I could always upload the data to the cgi server, but you use to ask us to keep the data off the cgi server. Is this still the case in this brave new world?

Someone may correct me, but I suspect with all the Joomla installs and such like going onto ccgi, your data aren't going to break the camel's back.
Gabe

[#4]

Allowing remote includes has been by far the biggest entry point for attackers exploiting the old platform, and if we had the ability to turn it off then, we would have done. It's only by moving to PHP5 that we have been able to do this.
If you have to use it, please make sure that there are no variables are used with include without proper sanitation. At the very least I would strongly recommend having register_globals set to Off.

[#5]

Thank you for the advice chaps, I've upped sticks and moved my meagre quantity of data across to the cgi sever. This way maybe we can keep the door shut.
Maybe if plusnet had been a bit quicker off the mark upgrading we may have avoided the mess in the first place, a lesson for the future maybe
--
cheers Ian Mac