---
 php.ini-recommended |  307 ++--------------------------------------------------
 1 file changed, 15 insertions(+), 292 deletions(-)

Index: php.ini-recommended
===================================================================
--- php.ini-recommended.orig	2007-08-22 01:24:18.000000000 +0200
+++ php.ini-recommended	2007-12-11 06:29:32.000000000 +0100
@@ -244,7 +244,9 @@ safe_mode_allowed_env_vars = PHP_
 ; This directive contains a comma-delimited list of environment variables that
 ; the end user won't be able to change using putenv().  These variables will be
 ; protected even if safe_mode_allowed_env_vars is set to allow to change them.
-safe_mode_protected_env_vars = LD_LIBRARY_PATH
+; the default is the same list ld.so uses when starting a setuid binary
+safe_mode_protected_env_vars = GCONV_PATH,GETCONF_DIR,HOSTALIASES,LD_AUDIT,LD_DEBUG,LD_DEBUG_OUTPUT,LD_DYNAMIC_WEAK,LD_LIBRARY_PATH,LD_ORIGIN_PATH,LD_PRELOAD,LD_PROFILE,LD_SHOW_AUXV,LD_USE_LOAD_BIAS,LOCALDOMAIN,LOCPATH,MALLOC_TRACE,NLSPATH,RESOLV_HOST_CONF,RES_OPTIONS,TMPDIR,TZDIR
+
 
 ; open_basedir, if set, limits all file operations to the defined directory
 ; and below.  This directive makes most sense if used in a per-directory
@@ -406,7 +408,7 @@ track_errors = Off
 
 ; Disable the inclusion of HTML tags in error messages.
 ; Note: Never use this feature for production boxes.
-;html_errors = Off
+html_errors = Off
 
 ; If html_errors is set On PHP produces clickable error messages that direct
 ; to a page describing the error or function causing the error in detail.
@@ -516,7 +518,7 @@ default_mimetype = "text/html"
 ;;;;;;;;;;;;;;;;;;;;;;;;;
 
 ; UNIX: "/path1:/path2"
-;include_path = ".:/php/includes"
+include_path = ".:/usr/share/php5:/usr/share/php5/PEAR"
 ;
 ; Windows: "\path1;\path2"
 ;include_path = ".;c:\php\includes"
@@ -533,12 +535,12 @@ doc_root =
 user_dir =
 
 ; Directory in which the loadable extensions (modules) reside.
-extension_dir = "./"
+extension_dir = @extdir@
 
 ; Whether or not to enable the dl() function.  The dl() function does NOT work
 ; properly in multithreaded servers, such as IIS or Zeus, and is automatically
 ; disabled on them.
-enable_dl = On
+enable_dl = Off
 
 ; cgi.force_redirect is necessary to provide security running PHP as a CGI under
 ; most web servers.  Left undefined, PHP turns this on by default.  You can
@@ -591,7 +593,7 @@ file_uploads = On
 
 ; Temporary directory for HTTP uploaded files (will use system default if not
 ; specified).
-;upload_tmp_dir =
+upload_tmp_dir = "/tmp"
 
 ; Maximum allowed size for uploaded files.
 upload_max_filesize = 2M
@@ -623,81 +625,6 @@ default_socket_timeout = 60
 ; fgets() and file() will work regardless of the source of the file.
 ; auto_detect_line_endings = Off
 
-
-;;;;;;;;;;;;;;;;;;;;;;
-; Dynamic Extensions ;
-;;;;;;;;;;;;;;;;;;;;;;
-;
-; If you wish to have an extension loaded automatically, use the following
-; syntax:
-;
-;   extension=modulename.extension
-;
-; For example, on Windows:
-;
-;   extension=msql.dll
-;
-; ... or under UNIX:
-;
-;   extension=msql.so
-;
-; Note that it should be the name of the module only; no directory information
-; needs to go here.  Specify the location of the extension with the
-; extension_dir directive above.
-
-
-; Windows Extensions
-; Note that ODBC support is built in, so no dll is needed for it.
-; Note that many DLL files are located in the extensions/ (PHP 4) ext/ (PHP 5)
-; extension folders as well as the separate PECL DLL download (PHP 5).
-; Be sure to appropriately set the extension_dir directive.
-
-;extension=php_bz2.dll
-;extension=php_curl.dll
-;extension=php_dba.dll
-;extension=php_dbase.dll
-;extension=php_exif.dll
-;extension=php_fdf.dll
-;extension=php_gd2.dll
-;extension=php_gettext.dll
-;extension=php_gmp.dll
-;extension=php_ifx.dll
-;extension=php_imap.dll
-;extension=php_interbase.dll
-;extension=php_ldap.dll
-;extension=php_mbstring.dll
-;extension=php_mcrypt.dll
-;extension=php_mhash.dll
-;extension=php_mime_magic.dll
-;extension=php_ming.dll
-;extension=php_msql.dll
-;extension=php_mssql.dll
-;extension=php_mysql.dll
-;extension=php_mysqli.dll
-;extension=php_oci8.dll
-;extension=php_openssl.dll
-;extension=php_pdo.dll
-;extension=php_pdo_firebird.dll
-;extension=php_pdo_mssql.dll
-;extension=php_pdo_mysql.dll
-;extension=php_pdo_oci.dll
-;extension=php_pdo_oci8.dll
-;extension=php_pdo_odbc.dll
-;extension=php_pdo_pgsql.dll
-;extension=php_pdo_sqlite.dll
-;extension=php_pgsql.dll
-;extension=php_pspell.dll
-;extension=php_shmop.dll
-;extension=php_snmp.dll
-;extension=php_soap.dll
-;extension=php_sockets.dll
-;extension=php_sqlite.dll
-;extension=php_sybase_ct.dll
-;extension=php_tidy.dll
-;extension=php_xmlrpc.dll
-;extension=php_xsl.dll
-;extension=php_zip.dll
-
 ;;;;;;;;;;;;;;;;;;;
 ; Module Settings ;
 ;;;;;;;;;;;;;;;;;;;
@@ -745,12 +672,6 @@ default_socket_timeout = 60
 define_syslog_variables  = Off
 
 [mail function]
-; For Win32 only.
-SMTP = localhost
-smtp_port = 25
-
-; For Win32 only.
-;sendmail_from = me@example.com
 
 ; For Unix only.  You may supply arguments as well (default: "sendmail -t -i").
 ;sendmail_path =
@@ -769,7 +690,7 @@ sql.safe_mode = Off
 ;odbc.default_pw    =  Not yet implemented
 
 ; Allow or prevent persistent links.
-odbc.allow_persistent = On
+odbc.allow_persistent = Off
 
 ; Check that a connection is still valid before reuse.
 odbc.check_persistent = On
@@ -791,7 +712,7 @@ odbc.defaultbinmode = 1
 
 [MySQL]
 ; Allow or prevent persistent links.
-mysql.allow_persistent = On
+mysql.allow_persistent = Off
 
 ; Maximum number of persistent links.  -1 means no limit.
 mysql.max_persistent = -1
@@ -860,50 +781,9 @@ mysqli.default_pw =
 ; Allow or prevent reconnect
 mysqli.reconnect = Off
 
-[mSQL]
-; Allow or prevent persistent links.
-msql.allow_persistent = On
-
-; Maximum number of persistent links.  -1 means no limit.
-msql.max_persistent = -1
-
-; Maximum number of links (persistent+non persistent).  -1 means no limit.
-msql.max_links = -1
-
-[OCI8]
-; enables privileged connections using external credentials (OCI_SYSOPER, OCI_SYSDBA)
-;oci8.privileged_connect = Off
-
-; Connection: The maximum number of persistent OCI8 connections per
-; process. Using -1 means no limit.
-;oci8.max_persistent = -1
-
-; Connection: The maximum number of seconds a process is allowed to
-; maintain an idle persistent connection. Using -1 means idle
-; persistent connections will be maintained forever.
-;oci8.persistent_timeout = -1
-
-; Connection: The number of seconds that must pass before issuing a
-; ping during oci_pconnect() to check the connection validity. When
-; set to 0, each oci_pconnect() will cause a ping. Using -1 disables
-; pings completely.
-;oci8.ping_interval = 60
-
-; Tuning: This option enables statement caching, and specifies how
-; many statements to cache. Using 0 disables statement caching.
-;oci8.statement_cache_size = 20
-
-; Tuning: Enables statement prefetching and sets the default number of
-; rows that will be fetched automatically after statement execution.
-;oci8.default_prefetch = 10
-
-; Compatibility. Using On means oci_close() will not close
-; oci_connect() and oci_new_connect() connections.
-;oci8.old_oci_close_semantics = Off
-
 [PostgresSQL]
 ; Allow or prevent persistent links.
-pgsql.allow_persistent = On
+pgsql.allow_persistent = Off
 
 ; Detect broken persistent links always with pg_pconnect().
 ; Auto reset feature requires a little overheads.
@@ -923,47 +803,6 @@ pgsql.ignore_notice = 0
 ; Unless pgsql.ignore_notice=0, module cannot log notice message.
 pgsql.log_notice = 0
 
-[Sybase]
-; Allow or prevent persistent links.
-sybase.allow_persistent = On
-
-; Maximum number of persistent links.  -1 means no limit.
-sybase.max_persistent = -1
-
-; Maximum number of links (persistent + non-persistent).  -1 means no limit.
-sybase.max_links = -1
-
-;sybase.interface_file = "/usr/sybase/interfaces"
-
-; Minimum error severity to display.
-sybase.min_error_severity = 10
-
-; Minimum message severity to display.
-sybase.min_message_severity = 10
-
-; Compatibility mode with old versions of PHP 3.0.
-; If on, this will cause PHP to automatically assign types to results according
-; to their Sybase type, instead of treating them all as strings.  This
-; compatibility mode will probably not stay around forever, so try applying
-; whatever necessary changes to your code, and turn it off.
-sybase.compatability_mode = Off
-
-[Sybase-CT]
-; Allow or prevent persistent links.
-sybct.allow_persistent = On
-
-; Maximum number of persistent links.  -1 means no limit.
-sybct.max_persistent = -1
-
-; Maximum number of links (persistent + non-persistent).  -1 means no limit.
-sybct.max_links = -1
-
-; Minimum server message severity to display.
-sybct.min_server_severity = 10
-
-; Minimum client message severity to display.
-sybct.min_client_severity = 10
-
 [bcmath]
 ; Number of decimal digits for all bcmath functions.
 bcmath.scale = 0
@@ -971,43 +810,6 @@ bcmath.scale = 0
 [browscap]
 ;browscap = extra/browscap.ini
 
-[Informix]
-; Default host for ifx_connect() (doesn't apply in safe mode).
-ifx.default_host =
-
-; Default user for ifx_connect() (doesn't apply in safe mode).
-ifx.default_user =
-
-; Default password for ifx_connect() (doesn't apply in safe mode).
-ifx.default_password =
-
-; Allow or prevent persistent links.
-ifx.allow_persistent = On
-
-; Maximum number of persistent links.  -1 means no limit.
-ifx.max_persistent = -1
-
-; Maximum number of links (persistent + non-persistent).  -1 means no limit.
-ifx.max_links = -1
-
-; If on, select statements return the contents of a text blob instead of its id.
-ifx.textasvarchar = 0
-
-; If on, select statements return the contents of a byte blob instead of its id.
-ifx.byteasvarchar = 0
-
-; Trailing blanks are stripped from fixed-length char columns.  May help the
-; life of Informix SE users.
-ifx.charasvarchar = 0
-
-; If on, the contents of text and byte blobs are dumped to a file instead of
-; keeping them in memory.
-ifx.blobinfile = 0
-
-; NULL's are returned as empty strings, unless this is set to 1.  In that case,
-; NULL's are returned as string 'NULL'.
-ifx.nullformat = 0
-
 [Session]
 ; Handler used to store/retrieve data.
 session.save_handler = files
@@ -1038,7 +840,7 @@ session.save_handler = files
 ;
 ; where MODE is the octal representation of the mode. Note that this
 ; does not overwrite the process's umask.
-;session.save_path = "/tmp"
+session.save_path = "/var/lib/php5"
 
 ; Whether to use cookies.
 session.use_cookies = 1
@@ -1047,7 +849,7 @@ session.use_cookies = 1
 
 ; This option enables administrators to make their users invulnerable to
 ; attacks which involve passing session ids in URLs; defaults to 0.
-; session.use_only_cookies = 1
+session.use_only_cookies = 1
 
 ; Name of the session (used as cookie name).
 session.name = PHPSESSID
@@ -1065,7 +867,7 @@ session.cookie_path = /
 session.cookie_domain =
 
 ; Whether or not to add the httpOnly flag to the cookie, which makes it inaccessible to browser scripting languages such as JavaScript.
-session.cookie_httponly = 
+session.cookie_httponly = 1
 
 ; Handler used to serialize data.  php is the standard serializer of PHP.
 session.serialize_handler = php
@@ -1106,14 +908,14 @@ session.bug_compat_warn = 1
 session.referer_check =
 
 ; How many bytes to read from the file.
-session.entropy_length = 0
+;session.entropy_length = 0
 
 ; Specified here to create the session id.
-session.entropy_file =
+;session.entropy_file = 
 
-;session.entropy_length = 16
+session.entropy_length = 16
 
-;session.entropy_file = /dev/urandom
+session.entropy_file = /dev/urandom
 
 ; Set to {nocache,private,public,} to determine HTTP caching aspects
 ; or leave this empty to avoid sending anti-caching headers.
@@ -1136,7 +938,7 @@ session.use_trans_sid = 0
 ; Select a hash function
 ; 0: MD5   (128 bits)
 ; 1: SHA-1 (160 bits)
-session.hash_function = 0
+session.hash_function = 1
 
 ; Define how many bits are stored in each character when converting
 ; the binary hash data to something readable.
@@ -1153,58 +955,6 @@ session.hash_bits_per_character = 5
 ; Note that all valid entries require a "=", even if no value follows.
 url_rewriter.tags = "a=href,area=href,frame=src,input=src,form=fakeentry"
 
-[MSSQL]
-; Allow or prevent persistent links.
-mssql.allow_persistent = On
-
-; Maximum number of persistent links.  -1 means no limit.
-mssql.max_persistent = -1
-
-; Maximum number of links (persistent+non persistent).  -1 means no limit.
-mssql.max_links = -1
-
-; Minimum error severity to display.
-mssql.min_error_severity = 10
-
-; Minimum message severity to display.
-mssql.min_message_severity = 10
-
-; Compatibility mode with old versions of PHP 3.0.
-mssql.compatability_mode = Off
-
-; Connect timeout
-;mssql.connect_timeout = 5
-
-; Query timeout
-;mssql.timeout = 60
-
-; Valid range 0 - 2147483647.  Default = 4096.
-;mssql.textlimit = 4096
-
-; Valid range 0 - 2147483647.  Default = 4096.
-;mssql.textsize = 4096
-
-; Limits the number of records in each batch.  0 = all records in one batch.
-;mssql.batchsize = 0
-
-; Specify how datetime and datetim4 columns are returned
-; On => Returns data converted to SQL server settings
-; Off => Returns values as YYYY-MM-DD hh:mm:ss
-;mssql.datetimeconvert = On
-
-; Use NT authentication when connecting to the server
-mssql.secure_connection = Off
-
-; Specify max number of processes. -1 = library default
-; msdlib defaults to 25
-; FreeTDS defaults to 4096
-;mssql.max_procs = -1
-
-; Specify client character set. 
-; If empty or not set the client charset from freetds.comf is used
-; This is only used when compiled with FreeTDS
-;mssql.charset = "ISO-8859-1"
-
 [Assertion]
 ; Assert(expr); active by default.
 ;assert.active = On
@@ -1222,18 +972,6 @@ mssql.secure_connection = Off
 ; error_reporting(0) around the eval().
 ;assert.quiet_eval = 0
 
-[COM]
-; path to a file containing GUIDs, IIDs or filenames of files with TypeLibs
-;com.typelib_file =
-; allow Distributed-COM calls
-;com.allow_dcom = true
-; autoregister constants of a components typlib on com_load()
-;com.autoregister_typelib = true
-; register constants casesensitive
-;com.autoregister_casesensitive = false
-; show warnings on duplicate constant registrations
-;com.autoregister_verbose = true
-
 [mbstring]
 ; language for internal character representation.
 ;mbstring.language = Japanese
@@ -1278,21 +1016,6 @@ mssql.secure_connection = Off
 ; enable strict encoding detection.
 ;mbstring.strict_encoding = Off
 
-[FrontBase]
-;fbsql.allow_persistent = On
-;fbsql.autocommit = On
-;fbsql.show_timestamp_decimals = Off
-;fbsql.default_database =
-;fbsql.default_database_password =
-;fbsql.default_host =
-;fbsql.default_password =
-;fbsql.default_user = "_SYSTEM"
-;fbsql.generate_warnings = Off
-;fbsql.max_connections = 128
-;fbsql.max_links = 128
-;fbsql.max_persistent = -1
-;fbsql.max_results = 128
-
 [gd]
 ; Tell the jpeg decode to libjpeg warnings and try to create
 ; a gd image. The warning will then be displayed as notices
