diff --git a/examples/10_www.sample b/examples/10_www.sample index 110a92ec..dc58cc1d 100644 --- a/examples/10_www.sample +++ b/examples/10_www.sample @@ -1,3 +1,3 @@ -Defaults env_keep += "workdir DIALOG NOCOLOR" +Defaults env_keep += "workdir DIALOG NOCOLOR CBSD_RNODE" Cmnd_Alias WEB_CMD = /usr/local/bin/cbsd www ALL=(ALL) NOPASSWD:SETENV: WEB_CMD diff --git a/examples/php-fpm.conf.sample b/examples/php-fpm.conf.sample index 4ee17724..978acc88 100644 --- a/examples/php-fpm.conf.sample +++ b/examples/php-fpm.conf.sample @@ -41,6 +41,24 @@ pid = run/php-fpm.pid ; Default Value: notice ;log_level = notice +; Log limit on number of characters in the single line (log entry). If the +; line is over the limit, it is wrapped on multiple lines. The limit is for +; all logged characters including message prefix and suffix if present. However +; the new line character does not count into it as it is present only when +; logging to a file descriptor. It means the new line character is not present +; when logging to syslog. +; Default Value: 1024 +;log_limit = 4096 + +; Log buffering specifies if the log line is buffered which means that the +; line is written in a single write operation. If the value is false, then the +; data is written directly into the file descriptor. It is an experimental +; option that can potentionaly improve logging performance and memory usage +; for some heavy logging scenarios. This option is ignored if logging to syslog +; as it has to be always buffered. +; Default value: yes +;log_buffering = no + ; If this number of child processes exit with SIGSEGV or SIGBUS within the time ; interval set by emergency_restart_interval then FPM will restart. A value ; of '0' means 'Off'. diff --git a/examples/php.ini.sample b/examples/php.ini.sample index 2ce521df..5fe18365 100644 --- a/examples/php.ini.sample +++ b/examples/php.ini.sample @@ -15,7 +15,7 @@ ; 5. The web server's directory (for SAPI modules), or directory of PHP ; (otherwise in Windows) ; 6. The directory from the --with-config-file-path compile time option, or the -; Windows directory (C:\windows or C:\winnt) +; Windows directory (usually C:\windows) ; See the PHP docs for more specific information. ; http://php.net/configuration.file @@ -58,9 +58,9 @@ ; An empty string can be denoted by simply not writing anything after the equal ; sign, or by using the None keyword: -; foo = ; sets foo to an empty string -; foo = None ; sets foo to an empty string -; foo = "None" ; sets foo to the string 'None' +; foo = ; sets foo to an empty string +; foo = None ; sets foo to an empty string +; foo = "None" ; sets foo to the string 'None' ; If you use constants in your value, and these constants belong to a ; dynamically loaded extension (either a PHP extension or a Zend extension), @@ -83,11 +83,12 @@ ; development version only in development environments, as errors shown to ; application users can inadvertently leak otherwise secure information. -; This is php.ini-production INI file. +; This is the php.ini-production INI file. ;;;;;;;;;;;;;;;;;;; ; Quick Reference ; ;;;;;;;;;;;;;;;;;;; + ; The following are all the settings which are different in either the production ; or development versions of the INIs with respect to PHP's default behavior. ; Please see the actual settings later in the document for more details as to why @@ -99,20 +100,15 @@ ; Production Value: Off ; display_startup_errors -; Default Value: Off +; Default Value: On ; Development Value: On ; Production Value: Off ; error_reporting -; Default Value: E_ALL & ~E_NOTICE & ~E_STRICT & ~E_DEPRECATED +; Default Value: E_ALL ; Development Value: E_ALL ; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT -; html_errors -; Default Value: On -; Development Value: On -; Production value: On - ; log_errors ; Default Value: Off ; Development Value: On @@ -153,23 +149,28 @@ ; Development Value: Off ; Production Value: Off -; track_errors -; Default Value: Off -; Development Value: On -; Production Value: Off - ; variables_order ; Default Value: "EGPCS" ; Development Value: "GPCS" ; Production Value: "GPCS" +; zend.exception_ignore_args +; Default Value: Off +; Development Value: Off +; Production Value: On + +; zend.exception_string_param_max_len +; Default Value: 15 +; Development Value: 15 +; Production Value: 0 + ;;;;;;;;;;;;;;;;;;;; ; php.ini Options ; ;;;;;;;;;;;;;;;;;;;; ; Name for user-defined php.ini (.htaccess) files. Default is ".user.ini" ;user_ini.filename = ".user.ini" -; To disable this feature set this option to empty value +; To disable this feature set this option to an empty value ;user_ini.filename = ; TTL for user-defined php.ini files (time-to-live) in seconds. Default is 300 seconds (5 minutes) @@ -248,7 +249,7 @@ output_buffering = 4096 ; Production Value: "form=" ;url_rewriter.tags -; URL rewriter will not rewrites absolute URL nor form by default. To enable +; URL rewriter will not rewrite absolute URL nor form by default. To enable ; absolute URL rewrite, allowed hosts must be defined at RUNTIME. ; Refer to session.trans_sid_hosts for more details. ; Default Value: "" @@ -294,6 +295,13 @@ implicit_flush = Off ; callback-function. unserialize_callback_func = +; The unserialize_max_depth specifies the default depth limit for unserialized +; structures. Setting the depth limit too high may result in stack overflows +; during unserialization. The unserialize_max_depth ini setting can be +; overridden by the max_depth option on individual unserialize() calls. +; A value of 0 disables the depth limit. +;unserialize_max_depth = 4096 + ; When floats & doubles are serialized, store serialize_precision significant ; digits after the floating point. The default value ensures that when floats ; are decoded with unserialize, the data will remain the same. @@ -305,15 +313,16 @@ serialize_precision = -1 ; open_basedir, if set, limits all file operations to the defined directory ; and below. This directive makes most sense if used in a per-directory ; or per-virtualhost web server configuration file. +; Note: disables the realpath cache ; http://php.net/open-basedir ;open_basedir = -; This directive allows you to disable certain functions for security reasons. +; This directive allows you to disable certain functions. ; It receives a comma-delimited list of function names. ; http://php.net/disable-functions disable_functions = -; This directive allows you to disable certain classes for security reasons. +; This directive allows you to disable certain classes. ; It receives a comma-delimited list of class names. ; http://php.net/disable-classes disable_classes = @@ -337,6 +346,7 @@ disable_classes = ; Determines the size of the realpath cache to be used by PHP. This value should ; be increased on systems where PHP opens many files to reflect the quantity of ; the file operations performed. +; Note: if open_basedir is set, the cache is disabled ; http://php.net/realpath-cache-size ;realpath_cache_size = 4096k @@ -353,15 +363,31 @@ zend.enable_gc = On ; If enabled, scripts may be written in encodings that are incompatible with ; the scanner. CP936, Big5, CP949 and Shift_JIS are the examples of such ; encodings. To use this feature, mbstring extension must be enabled. -; Default: Off ;zend.multibyte = Off ; Allows to set the default encoding for the scripts. This value will be used ; unless "declare(encoding=...)" directive appears at the top of the script. ; Only affects if zend.multibyte is set. -; Default: "" ;zend.script_encoding = +; Allows to include or exclude arguments from stack traces generated for exceptions. +; In production, it is recommended to turn this setting on to prohibit the output +; of sensitive information in stack traces +; Default Value: Off +; Development Value: Off +; Production Value: On +zend.exception_ignore_args = On + +; Allows setting the maximum string length in an argument of a stringified stack trace +; to a value between 0 and 1000000. +; This has no effect when zend.exception_ignore_args is enabled. +; Default Value: 15 +; Development Value: 15 +; Production Value: 0 +; In production, it is recommended to set this to 0 to reduce the output +; of sensitive information in stack traces. +zend.exception_string_param_max_len = 0 + ;;;;;;;;;;;;;;;;; ; Miscellaneous ; ;;;;;;;;;;;;;;;;; @@ -397,9 +423,9 @@ max_input_time = 60 ;max_input_nesting_level = 64 ; How many GET/POST/COOKIE input variables may be accepted -; max_input_vars = 1000 +;max_input_vars = 1000 -; Maximum amount of memory a script may consume (128MB) +; Maximum amount of memory a script may consume ; http://php.net/memory-limit memory_limit = 256M @@ -453,7 +479,7 @@ memory_limit = 256M ; E_ALL & ~E_NOTICE (Show all errors, except for notices) ; E_ALL & ~E_NOTICE & ~E_STRICT (Show all errors, except for notices and coding standards warnings.) ; E_COMPILE_ERROR|E_RECOVERABLE_ERROR|E_ERROR|E_CORE_ERROR (Show only errors) -; Default Value: E_ALL & ~E_NOTICE & ~E_STRICT & ~E_DEPRECATED +; Default Value: E_ALL ; Development Value: E_ALL ; Production Value: E_ALL & ~E_DEPRECATED & ~E_STRICT ; http://php.net/error-reporting @@ -477,11 +503,9 @@ error_reporting = E_ALL & ~E_DEPRECATED & ~E_STRICT display_errors = Off ; The display of errors which occur during PHP's startup sequence are handled -; separately from display_errors. PHP's default behavior is to suppress those -; errors from clients. Turning the display of startup errors on can be useful in -; debugging configuration problems. We strongly recommend you -; set this to 'off' for production servers. -; Default Value: Off +; separately from display_errors. We strongly recommend you set this to 'off' +; for production servers to avoid leaking configuration details. +; Default Value: On ; Development Value: On ; Production Value: Off ; http://php.net/display-startup-errors @@ -514,24 +538,14 @@ ignore_repeated_errors = Off ignore_repeated_source = Off ; If this parameter is set to Off, then memory leaks will not be shown (on -; stdout or in the log). This has only effect in a debug compile, and if +; stdout or in the log). This is only effective in a debug compile, and if ; error reporting includes E_WARNING in the allowed list ; http://php.net/report-memleaks report_memleaks = On -; This setting is on by default. +; This setting is off by default. ;report_zend_debug = 0 -; Store the last error/warning message in $php_errormsg (boolean). Setting this value -; to On can assist in debugging and is appropriate for development servers. It should -; however be disabled on production servers. -; This directive is DEPRECATED. -; Default Value: Off -; Development Value: Off -; Production Value: Off -; http://php.net/track-errors -;track_errors = Off - ; Turn off normal error reporting and emit XML-RPC error XML ; http://php.net/xmlrpc-errors ;xmlrpc_errors = 0 @@ -543,9 +557,6 @@ report_memleaks = On ; error message as HTML for easier reading. This directive controls whether ; the error message is formatted as HTML or not. ; Note: This directive is hardcoded to Off for the CLI SAPI -; Default Value: On -; Development Value: On -; Production value: On ; http://php.net/html-errors html_errors = On @@ -585,6 +596,26 @@ html_errors = On ; Log errors to syslog (Event Log on Windows). ;error_log = syslog +; The syslog ident is a string which is prepended to every message logged +; to syslog. Only used when error_log is set to syslog. +;syslog.ident = php + +; The syslog facility is used to specify what type of program is logging +; the message. Only used when error_log is set to syslog. +;syslog.facility = user + +; Set this to disable filtering control characters (the default). +; Some loggers only accept NVT-ASCII, others accept anything that's not +; control characters. If your logger accepts everything, then no filtering +; is needed at all. +; Allowed values are: +; ascii (all printable ASCII characters and NL) +; no-ctrl (all characters except control characters) +; all (all characters) +; raw (like "all", but messages are not split at newlines) +; http://php.net/syslog.filter +;syslog.filter = ascii + ;windows.show_crt_warning ; Default value: 0 ; Development value: 0 @@ -652,7 +683,7 @@ register_argc_argv = Off ; first used (Just In Time) instead of when the script starts. If these ; variables are not used within a script, having this directive on will result ; in a performance gain. The PHP directive register_argc_argv must be disabled -; for this directive to have any affect. +; for this directive to have any effect. ; http://php.net/auto-globals-jit auto_globals_jit = On @@ -734,13 +765,13 @@ user_dir = ; Directory in which the loadable extensions (modules) reside. ; http://php.net/extension-dir -; extension_dir = "./" +;extension_dir = "./" ; On windows: -; extension_dir = "ext" +;extension_dir = "ext" ; Directory where the temporary files should be placed. ; Defaults to the system default (see sys_get_temp_dir) -; sys_temp_dir = "/tmp" +;sys_temp_dir = "/tmp" ; Whether or not to enable the dl() function. The dl() function does NOT work ; properly in multithreaded servers, such as IIS or Zeus, and is automatically @@ -777,10 +808,9 @@ enable_dl = Off ; if cgi.discard_path is enabled, the PHP CGI binary can safely be placed outside ; of the web tree and people will not be able to circumvent .htaccess security. -; http://php.net/cgi.dicard-path ;cgi.discard_path=1 -; FastCGI under IIS (on WINNT based OS) supports the ability to impersonate +; FastCGI under IIS supports the ability to impersonate ; security tokens of the calling client. This allows IIS to define the ; security context that the request runs under. mod_fastcgi under Apache ; does not currently support this feature (03/17/2002) @@ -872,7 +902,7 @@ default_socket_timeout = 60 ; For example: ; ; extension=mysqli -; +; ; When the extension library to load is not located in the default extension ; directory, You may specify an absolute path to the library file: ; @@ -891,18 +921,20 @@ default_socket_timeout = 60 ; ;extension=bz2 ;extension=curl +;extension=ffi +;extension=ftp ;extension=fileinfo -;extension=gd2 +;extension=gd ;extension=gettext ;extension=gmp ;extension=intl ;extension=imap -;extension=interbase ;extension=ldap ;extension=mbstring ;extension=exif ; Must be after mbstring as it depends on it ;extension=mysqli ;extension=oci8_12c ; Use with Oracle Database 12c Instant Client +;extension=oci8_19 ; Use with Oracle Database 19 Instant Client ;extension=odbc ;extension=openssl ;extension=pdo_firebird @@ -920,11 +952,13 @@ default_socket_timeout = 60 ;extension=soap ;extension=sockets +;extension=sodium ;extension=sqlite3 ;extension=tidy -;extension=xmlrpc ;extension=xsl +;zend_extension=opcache + ;;;;;;;;;;;;;;;;;;; ; Module Settings ; ;;;;;;;;;;;;;;;;;;; @@ -945,10 +979,10 @@ cli_server.color = On ;date.default_longitude = 35.2333 ; http://php.net/date.sunrise-zenith -;date.sunrise_zenith = 90.583333 +;date.sunrise_zenith = 90.833333 ; http://php.net/date.sunset-zenith -;date.sunset_zenith = 90.583333 +;date.sunset_zenith = 90.833333 [filter] ; http://php.net/filter.default @@ -960,7 +994,7 @@ cli_server.color = On [iconv] ; Use of this INI entry is deprecated, use global input_encoding instead. ; If empty, default_charset or input_encoding or iconv.input_encoding is used. -; The precedence is: default_charset < intput_encoding < iconv.input_encoding +; The precedence is: default_charset < input_encoding < iconv.input_encoding ;iconv.input_encoding = ; Use of this INI entry is deprecated, use global internal_encoding instead. @@ -975,6 +1009,13 @@ cli_server.color = On ; otherwise output encoding conversion cannot be performed. ;iconv.output_encoding = +[imap] +; rsh/ssh logins are disabled by default. Use this INI entry if you want to +; enable them. Note that the IMAP library does not filter mailbox names before +; passing them to rsh/ssh command, thus passing untrusted data to this function +; with rsh/ssh enabled is insecure. +;imap.enable_insecure_rsh=0 + [intl] ;intl.default_locale = ; This directive allows you to produce PHP errors when some error @@ -984,22 +1025,33 @@ cli_server.color = On ;intl.use_exceptions = 0 [sqlite3] +; Directory pointing to SQLite3 extensions +; http://php.net/sqlite3.extension-dir ;sqlite3.extension_dir = +; SQLite defensive mode flag (only available from SQLite 3.26+) +; When the defensive flag is enabled, language features that allow ordinary +; SQL to deliberately corrupt the database file are disabled. This forbids +; writing directly to the schema, shadow tables (eg. FTS data tables), or +; the sqlite_dbpage virtual table. +; https://www.sqlite.org/c3ref/c_dbconfig_defensive.html +; (for older SQLite versions, this flag has no use) +;sqlite3.defensive = 1 + [Pcre] -;PCRE library backtracking limit. +; PCRE library backtracking limit. ; http://php.net/pcre.backtrack-limit ;pcre.backtrack_limit=100000 -;PCRE library recursion limit. -;Please note that if you set this value to a high number you may consume all -;the available process stack and eventually crash PHP (due to reaching the -;stack size limit imposed by the Operating System). +; PCRE library recursion limit. +; Please note that if you set this value to a high number you may consume all +; the available process stack and eventually crash PHP (due to reaching the +; stack size limit imposed by the Operating System). ; http://php.net/pcre.recursion-limit ;pcre.recursion_limit=100000 -;Enables or disables JIT compilation of patterns. This requires the PCRE -;library to be compiled with JIT support. +; Enables or disables JIT compilation of patterns. This requires the PCRE +; library to be compiled with JIT support. ;pcre.jit=1 [Pdo] @@ -1007,16 +1059,9 @@ cli_server.color = On ; http://php.net/pdo-odbc.connection-pooling ;pdo_odbc.connection_pooling=strict -;pdo_odbc.db2_instance_name - [Pdo_mysql] -; If mysqlnd is used: Number of cache slots for the internal result set cache -; http://php.net/pdo_mysql.cache_size -pdo_mysql.cache_size = 2000 - ; Default socket name for local MySQL connects. If empty, uses the built-in ; MySQL defaults. -; http://php.net/pdo_mysql.default-socket pdo_mysql.default_socket= [Phar] @@ -1098,39 +1143,6 @@ odbc.defaultlrl = 4096 ; http://php.net/odbc.defaultbinmode odbc.defaultbinmode = 1 -;birdstep.max_links = -1 - -[Interbase] -; Allow or prevent persistent links. -ibase.allow_persistent = 1 - -; Maximum number of persistent links. -1 means no limit. -ibase.max_persistent = -1 - -; Maximum number of links (persistent + non-persistent). -1 means no limit. -ibase.max_links = -1 - -; Default database name for ibase_connect(). -;ibase.default_db = - -; Default username for ibase_connect(). -;ibase.default_user = - -; Default password for ibase_connect(). -;ibase.default_password = - -; Default charset for ibase_connect(). -;ibase.default_charset = - -; Default timestamp format. -ibase.timestampformat = "%Y-%m-%d %H:%M:%S" - -; Default date format. -ibase.dateformat = "%Y-%m-%d" - -; Default time format. -ibase.timeformat = "%H:%M:%S" - [MySQLi] ; Maximum number of persistent links. -1 means no limit. @@ -1149,10 +1161,6 @@ mysqli.allow_persistent = On ; http://php.net/mysqli.max-links mysqli.max_links = -1 -; If mysqlnd is used: Number of cache slots for the internal result set cache -; http://php.net/mysqli.cache_size -mysqli.cache_size = 2000 - ; Default port number for mysqli_connect(). If unset, mysqli_connect() will use ; the $MYSQL_TCP_PORT or the mysql-tcp entry in /etc/services or the ; compile-time value defined MYSQL_PORT (in that order). Win32 will only look @@ -1165,11 +1173,11 @@ mysqli.default_port = 3306 ; http://php.net/mysqli.default-socket mysqli.default_socket = -; Default host for mysql_connect() (doesn't apply in safe mode). +; Default host for mysqli_connect() (doesn't apply in safe mode). ; http://php.net/mysqli.default-host mysqli.default_host = -; Default user for mysql_connect() (doesn't apply in safe mode). +; Default user for mysqli_connect() (doesn't apply in safe mode). ; http://php.net/mysqli.default-user mysqli.default_user = @@ -1187,12 +1195,10 @@ mysqli.reconnect = Off [mysqlnd] ; Enable / Disable collection of general statistics by mysqlnd which can be ; used to tune and monitor MySQL operations. -; http://php.net/mysqlnd.collect_statistics mysqlnd.collect_statistics = On ; Enable / Disable collection of memory usage statistics by mysqlnd which can be ; used to tune and monitor MySQL operations. -; http://php.net/mysqlnd.collect_memory_statistics mysqlnd.collect_memory_statistics = Off ; Records communication from all extensions using mysqlnd to the specified log @@ -1201,29 +1207,23 @@ mysqlnd.collect_memory_statistics = Off ;mysqlnd.debug = ; Defines which queries will be logged. -; http://php.net/mysqlnd.log_mask ;mysqlnd.log_mask = 0 ; Default size of the mysqlnd memory pool, which is used by result sets. -; http://php.net/mysqlnd.mempool_default_size ;mysqlnd.mempool_default_size = 16000 ; Size of a pre-allocated buffer used when sending commands to MySQL in bytes. -; http://php.net/mysqlnd.net_cmd_buffer_size ;mysqlnd.net_cmd_buffer_size = 2048 ; Size of a pre-allocated buffer used for reading data sent by the server in ; bytes. -; http://php.net/mysqlnd.net_read_buffer_size ;mysqlnd.net_read_buffer_size = 32768 ; Timeout for network requests in seconds. -; http://php.net/mysqlnd.net_read_timeout ;mysqlnd.net_read_timeout = 31536000 ; SHA-256 Authentication Plugin related. File with the MySQL server public RSA ; key. -; http://php.net/mysqlnd.sha256_server_public_key ;mysqlnd.sha256_server_public_key = [OCI8] @@ -1351,10 +1351,11 @@ session.save_handler = files ;session.save_path = "/tmp" ; Whether to use strict session mode. -; Strict session mode does not accept uninitialized session ID and regenerate -; session ID if browser sends uninitialized session ID. Strict mode protects -; applications from session fixation via session adoption vulnerability. It is -; disabled by default for maximum compatibility, but enabling it is encouraged. +; Strict session mode does not accept an uninitialized session ID, and +; regenerates the session ID if the browser sends an uninitialized session ID. +; Strict mode protects applications from session fixation via a session adoption +; vulnerability. It is disabled by default for maximum compatibility, but +; enabling it is encouraged. ; https://wiki.php.net/rfc/strict_sessions session.use_strict_mode = 0 @@ -1392,20 +1393,24 @@ session.cookie_path = / ; http://php.net/session.cookie-domain session.cookie_domain = -; Whether or not to add the httpOnly flag to the cookie, which makes it inaccessible to browser scripting languages such as JavaScript. +; Whether or not to add the httpOnly flag to the cookie, which makes it +; inaccessible to browser scripting languages such as JavaScript. ; http://php.net/session.cookie-httponly session.cookie_httponly = -; Handler used to serialize data. php is the standard serializer of PHP. +; Add SameSite attribute to cookie to help mitigate Cross-Site Request Forgery (CSRF/XSRF) +; Current valid values are "Strict", "Lax" or "None". When using "None", +; make sure to include the quotes, as `none` is interpreted like `false` in ini files. +; https://tools.ietf.org/html/draft-west-first-party-cookies-07 +session.cookie_samesite = + +; Handler used to serialize data. php is the standard serializer of PHP. ; http://php.net/session.serialize-handler session.serialize_handler = php -; Defines the probability that the 'garbage collection' process is started -; on every session initialization. The probability is calculated by using -; gc_probability/gc_divisor. Where session.gc_probability is the numerator -; and gc_divisor is the denominator in the equation. Setting this value to 1 -; when the session.gc_divisor value is 100 will give you approximately a 1% chance -; the gc will run on any give request. +; Defines the probability that the 'garbage collection' process is started on every +; session initialization. The probability is calculated by using gc_probability/gc_divisor, +; e.g. 1/100 means there is a 1% chance that the GC process starts on each request. ; Default Value: 1 ; Development Value: 1 ; Production Value: 1 @@ -1413,13 +1418,9 @@ session.serialize_handler = php session.gc_probability = 1 ; Defines the probability that the 'garbage collection' process is started on every -; session initialization. The probability is calculated by using the following equation: -; gc_probability/gc_divisor. Where session.gc_probability is the numerator and -; session.gc_divisor is the denominator in the equation. Setting this value to 1 -; when the session.gc_divisor value is 100 will give you approximately a 1% chance -; the gc will run on any give request. Increasing this value to 1000 will give you -; a 0.1% chance the gc will run on any give request. For high volume production servers, -; this is a more efficient approach. +; session initialization. The probability is calculated by using gc_probability/gc_divisor, +; e.g. 1/100 means there is a 1% chance that the GC process starts on each request. +; For high volume production servers, using a value of 1000 is a more efficient approach. ; Default Value: 100 ; Development Value: 1000 ; Production Value: 1000 @@ -1435,8 +1436,8 @@ session.gc_maxlifetime = 1440 ; (see session.save_path above), then garbage collection does *not* ; happen automatically. You will need to do your own garbage ; collection through a shell script, cron entry, or some other method. -; For example, the following script would is the equivalent of -; setting session.gc_maxlifetime to 1440 (1440 seconds = 24 minutes): +; For example, the following script is the equivalent of setting +; session.gc_maxlifetime to 1440 (1440 seconds = 24 minutes): ; find /path/to/sessions -cmin +24 -type f | xargs rm ; Check HTTP Referer to invalidate externally stored URLs containing ids. @@ -1488,7 +1489,7 @@ session.sid_length = 26 session.trans_sid_tags = "a=href,area=href,frame=src,form=" ; URL rewriter does not rewrite absolute URLs by default. -; To enable rewrites for absolute pathes, target hosts must be specified +; To enable rewrites for absolute paths, target hosts must be specified ; at RUNTIME. i.e. use ini_set() ;