Upgrade to Pro — share decks privately, control downloads, hide ads and more …

php.iniの話

uzulla
December 03, 2016

 php.iniの話

builderscon tokyo 2016
20161203
uzulla

uzulla

December 03, 2016

Transcript

272 slides
  1. !!!!!! » Nullable types » Void return type » Iterable

    pseudo-type » Class constant visiblity modifiers » Square bracket syntax for list() and the ability to specify keys in list() » Catching multiple exceptions types
  2. mbؔ਺͸ɺѻ͏จࣈίʔυΛઃఆ͔Β൑அ͍ͯ͠Δ php > var_dump( ini_get("mbstring.internal_encoding")); string(5) "UTF-8" » ͔ͩΒɺ͖͞΄Ͳmb_strlen͕ਖ਼͘͠਺͑ΒΕͨ »

    mbstring.internal_encodingͱ͍͏Ωʔʹɺ "UTF-8"ͱ͍͏஋͕͸͍͍ͬͯ·͢ɻ ͜Ε͕php.iniͷઃఆͰ͢ɻ » ͜͏͍͏ઃఆ͕ɺʢ؀ڥʹΑΔ͕ʣΏ͏ʹ200ݸҎ্͋Δ
  3. ઃఆΛɺUTF-8͔Βม͑ͯΈΔ php > echo mb_strlen("͍͋͏͓͑"); 5 php > ini_set("mbstring.internal_encoding", "SJIS-win");

    php > echo mb_strlen("͍͋͏͓͑"); 8 » ͱ͍͏͜ͱͰɺ಺෦ॲཧΛSJIS-win(cp932)ʹ͢Δͱ… » ͦͷ৔͔ΒΤϥʔ΋ͳ͘ɺจࣈ਺͕ਖ਼͘͠Χ΢ϯτͰ͖ͳ͘ͳΔɻ
  4. PHP3.0ͷphp.ini-distʢൈਮʣ [PHP_3] engine = On ; enable PHP 3.0 parser

    short_open_tag = On ; allow the <? tag. otheʙ precision = 14 ; number of significant dʙ y2k_compliance = Off ; whether to be year 2000ʙ safe_mode = Off safe_mode_exec_dir = max_execution_time = 30 ; Maximum execution tiʙ memory_limit = 8388608 ; Maximum amount of meʙ error_reporting = 7
  5. PHP7ͷiniʢൈਮ [PHP] engine = On short_open_tag = Off precision =

    14 serialize_precision = 17 zend.enable_gc = On expose_php = On max_execution_time = 30 max_input_time = 60 memory_limit = 128M error_reporting = E_ALL & ~E_DEPRECATED & ~E_STRICT
  6. ؀ڥͷࠩΛຒΊͯΔͷ͕SAPI » SAPI͕ɺ؀ڥͱPHPΤϯδϯͷؒͰͱΓͳ͍ͯ͠Δ » SAPIͷ͓ӄͰɺphpʢͰॻ͔ΕͨϓϩάϥϜʣ͸ » echo͢Ε͹ϒϥ΢βʹग़Δ » Τϥʔ͕ΤϥʔϩάʹͰΔ »

    $_POST΍$_FILEͰύϥϝλ͕ͱΕΔ » ແ৺Ͱηογϣϯ͕࢖͑Δʢ$_COOKIE౳ɺhttpϔομʣ » …ͱ͍ͬͨ͜ͱ͕ීวతʹѻ͑Δ
  7. [PHP] ;;;;;;;;;;;;;;;;;;; ; About php.ini ; ;;;;;;;;;;;;;;;;;;; ; PHP's initialization

    file, generally called php.ini, is responsible for ; configuring many of the aspects of PHP's behavior. ུ engine = On expose_php = On max_execution_time = 30 max_input_time = 60
  8. Ͳ͜ʹ͋Δͷ͔! » /etc ҎԼΛ୳͢ » CLIͰ php --ini » phpinfo()

    ͷʮLoaded Configuration Fileʯͱ ʮAdditional .ini files parsedʯ » php_ini_loaded_file() ͱ php_ini_scanned_files();ͷฦ஋
  9. ௐ΂͍ͨॴʹίʔυૠೖ $info = php_ini_loaded_file().",\n"; $info .= php_ini_scanned_files(); error_log($info); // ϑΝΠϧʹग़ྗ

    ҎԼ݁Ռ /Users/uzulla/.phpenv/versions/7.0.1/etc/php.ini, /Users/uzulla/.phpenv/versions/7.0.1/etc/conf.d/xdebug.ini, /Users/uzulla/.phpenv/versions/7.0.1/etc/conf.d/my_special.ini
  10. » phpʹ͸error_log()ͱ͍͏ศརؔ਺͕͋Δ » error_log($info); » نఆͷΤϥʔϩάʹͰ·͢ » ʢͨͱ͑͹ɺapacheͷerror_logʹग़Δʣ » error_log($info,

    $filename); ͱϑΝΠϧ໊ࢦఆ΋Ͱ͖·͢ » ʮ௕͍ͱ੾ΓࣺͯΒΕΔͷͰɺͦͷ৔߹͸php.iniͰ log_errors_max_lenΛ;΍͠·͠ΐ͏ʯʮ͏ʔΜʯ
  11. » Config file scan directoryͱΑ͹Εɺ࠷ۙΑ͔ͭ͘ΘΕ͍ͯ·͢ » php --ini ౳Ͱ͠Β΂ΒΕ·͢(Scan for

    additional .ini files) » ༗ΔσΟϨΫτϦҎԼͷ *.ini ͕શ෦ಡ·Ε·͢ɺ/etc/php.ini ͱ ಉ౳ » ʮΠϯϑϥετϥΫνϟʔΞζίʔυʹͽͬͨΓ!ʯ » ʢphp.iniͷઃఆΛॻ͖׵͑Δͷʹɺsedͱ͔΋͏ͨ͘͠ͳ͍͔Β Ͷ…ʣ » ͳ͓ɺಉҰͷઃఆهड़͕͋ͬͨ৔߹ɺ্ॻ͖͞Ε·͢
  12. ϑΥʔϚοτʹ͍ͭͯ ; comment here [hoge] key = value key2 =

    "this is value2" key3 = On key4 = This is value4 ; ΫΦʔτ͸࣮͸ෆཁ
  13. ҎԼͷߦɺͲΕ͕ʮΤϥʔʯʂʁ k1 = 1 k2 = True k3 = On

    k4 = "On" k5 = text contain new line. k6 = text
  14. Ͳ͜Ͱ΋ઃఆͰ͖ͯศརͳphpͷઃఆ৔ॴࣄྫ » php.ini ΍ scan dirͷ.ini » httpd.conf ΍ nginx.conf

    » .htaccess ΍ .user.ini » ϢʔβʔϓϩάϥϜ಺ » ʮ͋Δؔ਺(౳)Λ࣮ߦ͢Δͱɺ҉໧ʹมΘΔʯ » ؀ڥม਺ɺWindowsͷϨδετϦ…etcetc
  15. ௐ΂ΔͨΊͷؔ਺ » phpinfo > লུ » ini_get > Α͔ͭ͘͏ »

    ini_get_all > ࢲ͸Α͔ͭ͘͏ » get_cfg_var > ໨త͕ҧ͏
  16. ini_get() » ini_get ( string $varname ) » ݱࡏͷઃఆΛҰͭऔಘͰ͖Δ »

    ⚠ࣦഊ࣌ʹ͸False͕ฦΔ » ⚠ฦ஋͸ʮStringʯͰ͋Δ
  17. // php.iniʢϑΝΠϧʣͰ͸ Off ͩͱ… short_open_tag = Off // ͜ͷΑ͏ʹۭจࣈ͕ฦͬͯ͘Δ php

    > var_dump(ini_get('short_open_tag')); string(0) "" » php.ini هड़ͷ··Ͱ͸ͳ͍ʢྫ֎΋͋Δʣ » มΘΔͷ͸ྑ͍͕ɺॳݟࡴ͠Ͱ͢ » ͳͥ On/Offɺtrue/falseɺ1/0 ౳Ͱͳ͍ͷ͔… » ʮࣗಈม׵ͷPHPͰ͢ɺ׳Ε·͠ΐ͏!ʯ
  18. php > var_dump( ini_get('upload_max_filesize')); string(4) "2M" » upload_max_filesize ͸هड़͕ͦͷ··Ͱ͖ͯ·͢ »

    upload_max_filesize ͷࢦఆʹ͸ɺK,M,GͳͲͷ୹ॖه๏͕࢖͑ͯਓ ͕ಡΈ΍͘͢Ͱ͖Δɻ » http://php.net/manual/ja/ faq.using.php#faq.using.shorthandbytes » ͔͜͠͠ΕʹΑͬͯҾ͖ى͜͞ΕΔ൵ܶʂ()
  19. php > echo ini_get('upload_max_filesize'); 2M // 2Mbyte = 2*1024*1024 if(

    1*1024*1024 > ini_get('upload_max_filesize') ) { die("plz more!!!"); } //-> plz more!! // ͋ΕΕΕʁ php > echo (int)"2M"; // "2M"Λ਺஋΁Ωϟετ 2 » ⚠օ͞Μ͝ଘ͡ɺ"2M" ͕ධՁͰ 2 ʹͳΔ҆ఆͷࣗಈม׵ » ͪͳΈʹɺ୹ॖه๏ΛόΠτʹม׵͢Δؔ਺͸ͳ͍ɻͳΜͰ΍… » ֤ࣗॻ͔͘ɺൿ఻ͷͨΕΛάάΓ·͠ΐ͏(෗ͬͯͳ͍͔֬ೝ΋)
  20. php > var_dump(ini_get_all()); array(233) { ["allow_url_fopen"]=> // Ωʔ໊ array(3) {

    ["global_value"]=> // άϩʔόϧͷ஋ʢʁʣ string(1) "1" ["local_value"]=> // ݱࡏͷ஋ string(1) "1" ["access"]=> // ΞΫηεϨϕϧ int(4) }
  21. php > var_dump(ini_get('upload_tmp_dir')); string(0) "" php > var_dump(ini_get_all(null, false)['upload_tmp_dir']); NULL

    // ಥવͷNULLʂʂ » ʮ໊લ͕ࣅͯΔ͚ͩͰɺೋͭؔ਺ͷฦ஋͕ಉ͡ͱ୭͕ݴͬͨʁʯ » ຊདྷ upload_tmp_dir ͸ɺ(php.netᐌ͘)σϑΥϧτ͕NULL » ini_getͷ΄͏͕ਖ਼͘͠(?)ͳ͍ » ܕΛҙࣝͨ͘͠ͳΓ·͢Ͷʂ
  22. ΈΜͳେ޷͖print_r͸… php > echo print_r("",1); // ͳʹ΋Ͱͳ͍ php > echo

    print_r(null,1); // ͳʹ΋Ͱͳ͍ php > echo print_r(true,1); // true͸1ʹͳΔ… 1 » ͜ͷΑ͏ʹprint_r͸ܕΛͩ͞ͳ͍ » ͠ܕͳ͍ͷͰɺผͷಓ۩͕ඞཁ
  23. meanwhile in php conference 2015... » PHP࡞ऀͷϥεϜε͕͖͍ͯͨ » ʮࣃϒϥγʯͰ༗໊ͳਓ »

    ϔλͳӳޠͰ͜ͷ݅Λ௚ૌ࣭໰ » ࡞ऀʮͦΕ͸ͦ͏͍͏΋ͷͩɺobΛ͔ͭ͑!ʯࢲʮ͸͍…"ʯ » PHPʹٹ͍͸ͳ͔ͬͨ » ࢲʹ৯͍Լ͕Δӳޠྗ΋ͳ͔ͬͨ(fin…)
  24. serialize() php > echo serialize(0); // i:0; php > echo

    serialize("false"); // s:5:"false"; php > echo serialize(false); // b:0; php > echo serialize(null); // N; » Ұจࣈ໨Ͱܕ͕Θ͔ͬͯศརʂ! » i:int, s:string, b:bool, N:null » օɺPHPͷγϦΞϥΠζܗࣜΛಡΉΑ͏ʹͳΓ·͢ʢΑͶʁʣ
  25. json_encode php > echo json_encode(""); // "" php > echo

    json_encode(null); // null php > echo json_encode(true); // true php > echo json_encode("true"); // "true" php > echo json_encode(1); // 1 php > echo json_encode("1"); // "1" » ܕ΋ɺͪΌΜͱΈΕ͹Θ͔Δ!
  26. ݸʑͰͳ͘ɺશ෦ͷઃఆΛݟ͍ͨ࣌͸ php > echo json_encode(ini_get_all(null,false), JSON_PRETTY_PRINT); { "allow_url_fopen": "1", "allow_url_include":

    "", "arg_separator.input": "&", » ݁ՌΛjson_encodeͰɺJSON_PRETTY_PRINT » ൺֱʹ΋ศརͰ͢ʢॏཁʣ!
  27. jsonͱdiffͰࡶʹൺֱ͢Δྫ! $ diff 56.json 7.json 26c25 < "date.timezone": "Asia\/Tokyo", ---

    > "date.timezone": "", 42c41 < "error_reporting": "-1", --- > "error_reporting": "22527", » ֤ࣗπʔϧΛద౰ʹ
  28. ini_set » ini_set ( string $varname , string $newvalue )

    » Ωʔͱ஋Ληοτ͠·͢ » ஋͸StringͰ͢ʢ஫ҙʣ » ⚠ฦ஋͸ʮมߋલͷ஋ʯͰ͢ʢ஫ҙʣ » ⚠ࣦഊ࣌͸FALSE͕ฦΓ·͢ʢ஫ҙʣ » ⚠ઃఆͰ͖ͳ͍΋ͷ΋͋Γ·͢(ޙड़)
  29. php > ini_set('mbstring.strict_detection', 'On'); php > var_dump(ini_get('mbstring.strict_detection')); string(2) "On" php

    > var_dump(mb_get_info()['strict_detection']); string(3) "Off" <-- !!?? » mbstring.strict_detectionͰ֬ೝ » boolܕͳͷͰɺphp.iniͰ͸"On"Λࢦఆ͢Δ » ͔͠͠ini_set ͸ɺ"On"Λਖ਼͘͠ड͚෇͚·ͤΜʂ!
  30. ࢿྉΛΈͯΈ·͠ΐ͏ » php.iniͰ͸ true/false,on/off, yes/no, none ͱࢦఆ͢Δ http://php.net/manual/ja/configuration.file.php ; ࿦ཧ஋͸ɺ࣍ͷ͍ͣΕ͔Ͱࢦఆ͠·͢

    ; true, on, yes ; ·ͨ͸ false, off, no, none » ͔͠͠ɺ"true"Λ͍ΕΔͱɺΦϑʹͳΔ…ͷ͕… » ·͕ͪ͑ͳ͚Ε͹Ͳ͏ͱ͍͏͜ͱ͸ͳ͍!
  31. CLI » /etc/php.ini౳ » ͋Δ͍͸-c /path/to/php.ini php.iniΛύεͰࢦఆ » ͋Δ͍͸/etc/php-cli.ini ͷઃஔ

    » ຊདྷͷphp.iniͷdirʹɺphp-{SAPI໊}.ini͕͋Δͱphp.iniʹ༏ ઌ͞ΕΔ
  32. mod_phpͷ௥ՃσΟϨΫςΟϒ » php_value key value ͱStringͷઃఆ͕Մೳ » php_admin_value ಉ্͕ͩɺϢʔβ͕ઃఆ্ॻ͖Ͱ͖ͳ͘ͳΔ »

    php_flag key on ͱBoolͷઃఆ͕Մೳ » php_admin_flag ಉ্͕ͩɺϢʔβ͕ઃఆ্ॻ͖Ͱ͖ͳ͘ͳΔ
  33. CGI » /etc/php.iniͳͲ » .user.ini » .htaccessͷphp_value౳ͷ୅༻ɺه๏͸php.iniͱಉ͡ » ಉҰDir͔ΒDocRoot·Ͱͷؒʹઃஔ͢Δ »

    Ұ౓ಡΉͱσϑΥϧτͰ̑෼Ωϟογϡ͞Ε·͢ » publicʹஔ͘=࿙Ӯʹ஫ҙʂʢ.htaccessΈ͍ͨʹ403ʹ͠Α͏ʣ
  34. σϑΥϧτมߋΛ֬ೝ͢Δ » php.netʹ͸ʮ෇࿥ʯͱ͍͏ʮ͜Εͦ͜ຊฤʯΈ͍ͨͳ৘ใ͕͋Δ » ͦ͜ΛͪΌΜͱνΣοΫ͢Ε͹ɺେମେৎ෉ » php -n -aͰiniΛϩʔυͤͣʹini_get_allΛಈ͔ͯ͠ɺࠩΛݟΔ »

    ͕ࠩ͋ͬͨΒɺద੾ʹຒΊΔiniΛॻ͘ // ϦϞʔτͱखݩΛ֬ೝ͢Δ༗໊ςΫɻ͕ͩɺલड़ͨ͠Α͏ʹ҆қʹcliͰ֬ೝ͢Δͷ͸͓קΊ͠ͳ͍ɻ diff <(php -r 'phpinfo();') <(~/.phpenv/versions/5.6.9/bin/php -r 'phpinfo();') diff <(php -r 'phpinfo();') <(ssh remote 'php -r "phpinfo();"') diff <(ssh remote1 'php -r "phpinfo();"') <(ssh remote2 'php -r "phpinfo();"')
  35. log_errors = On ; ͦ΋ͦ΋ΤϥʔϩάΛऔΔ͔ error_reporting = E_ALL & ~E_DEPRECATED

    & ~E_STRICT display_errors = Off ; ը໘ʹΤϥʔΛग़͔͢ display_startup_errors = Off ; PHPͷىಈγʔέϯεʹ͓͍ͯൃੜͨ͠ΤϥʔΛը໘ʹग़͔͢ log_errors_max_len = 1024 ; Τϥʔϩάͷ࠷௕ʢ੾Γࣺͯ error_log = ; ग़ྗઌɺলུ࣌SAPI΁ html_errors = On ; SAPI΁ग़ྗ࣌ɺΤϥʔจࣈྻΛhtmlԽ͢Δ͔
  36. » error_reporting ʹεΠονࢦఆ͢Δ » දݱ͸਺஋͕ͩɺఆ਺ͷϏοτԋࢉͰࢦఆͰ͖Δ » PHPer͕།ҰϏοτԋࢉΛ͢Δ৔Ͱ͢ʢʁʣ » ྫ E_ALL

    & ~E_DEPRECATED & ~E_STRICT » = 22527 ɺ֮͑ΒΕΔ͔ʂ(ͳͷͰbitԋࢉ) » શ෦ͷΤϥʔ͔Βɺඇਪ঑ΤϥʔͱɺStrictΤϥʔΛൈ͍ͯΔ » ఆ਺ͳͷͰ*.ini΍ini_setҎ֎Ͱ͸͜ͷه๏͸͔ͭ͑ͳ͍ » ʮԿ΋ߟ͑ͣɺ-1 ʹ͓͚ͯ͠͹Φοέʔʯʢݸਓͷײ૝Ͱ͢ʣ
  37. » ⚠error_log͸ɺphp.iniͰࢦఆ͠ͳ͍΄͏͕͍͍ » ⚠Builtin server΍CLIͰը໘ʹΤϥʔͰͯ͜ͳ͘ͳΓ·͢(᠘) » SAPIଆͷphp_value౳Ͱઃఆ͢Δͷ͕ྑ͍Ͱ͠ΐ͏ » (͋Δ͍͸ɺہॴini_set͕Α͍͔ͱ) php

    > echo ini_get("error_log"); /tmp/php_errors.log php > echo $a; // ະఆٛม਺Λ৮͍ͬͯΔͷͰɺΤϥʔ͕ͰΔ͸͕ͣͩग़ͳ͍ php > ^D $ tail /tmp/php_errors.log [XXXX] PHP Notice: Undefined variable: a in php shell code on line 1
  38. » ϩάϩʔςʔγϣϯͱ͔ɺແ͍ɻ // init.dͰɺ؀ڥม਺ࢦఆͰɺޙ͸࠶ىಈͰ…ʂʁ export D_OF_WEEK=`date +%w` rm -f /path/to/php_errorlog.$D_OF_WEEK

    // php.ini error_log = php_errorlog.${D_OF_WEEK} - ʢδϣʔΫͰ͢ʣ - ૉ௚ʹlogrotateઃఆͯ͠࠶ىಈͨ͠΄͏͕ປ͕ߴ͍Ͱ͢ - ύΠϓͰ͖ͳ͍ͷͰɺ rotatelogsͱ͔͸࢖͑͵
  39. -1

  40. » error_reporting = -1 ͕࠷ڧ! » ʢલड़ͷ௨Γ੔਺ͳͷͰʣ֬ೝ͠΍͍͢͠ » ʮ͔͠͠ݱ࣮ੈք͸ਏ͍ۤ͘͠"ʯ »

    E_NOTICE͕མͱͯ͋ͬͨ͠ΒɺղΓ΍͍͢ةݥϑϥά » <s>ෆՄආͳίʔυ͸ɺͦ͜Ͱ͚ͩerror_reportingΛม͑ͨΓ@Λ ͚ͭΑ͏ɺ΍ͬͺΓPHP͸ศར</s>
  41. date.timezone ·ΘΓ date.timezone = "Asia/Tokyo" ;date.default_latitude = 31.7667 ;date.default_longitude =

    35.2333 ;date.sunrise_zenith = 90.583333 ;date.sunset_zenith = 90.583333
  42. ༨ஊɿṖͷҢ౓ܦ౓ ;date.default_latitude = 31.7667 ;date.default_longitude = 35.2333 ;date.sunrise_zenith = 90.583333

    ;date.sunset_zenith = 90.583333 » ʮdate_sunrise() ͱ date_sunset() ͰͷΈ࢖༻͞Ε·͢ɻʯ » ͳΜͱద੾ʹઃఆ͢Δ͜ͱͰ೔ͷग़ͱ೔ͷೖΓΛܭࢉͰ͖·͢ʂ » php.iniʹ࣋ͭඞཁ͕͋ΔͷͩΖ͏͔…ਂԕͳΔཧ༝͕͋Γͦ͏ʂ
  43. ৭ʑ͋Δ͚Ͳɺେ఍͜ΕͰΑ͍✅ default_charset = "UTF-8" ; Content-Type ͷσϑΥϧτ internal_encoding = "UTF-8"

    [mbstring] mbstring.language = Japanese mbstring.internal_encoding = "UTF-8" mbstring.strict_detection = On
  44. ༨ஊ(ʁ)ʮdefault_charsetͱ͸Ұମ…ʯ ; Use of this INI entry is deprecated, use

    global internal_encoding instead. ; internal/script encoding. ; Some encoding cannot work as internal encoding. (e.g. SJIS, BIG5, ISO-2022-*) ; If empty, default_charset or internal_encoding or iconv.internal_encoding is used. ; The precedence is: default_charset < internal_encoding < iconv.internal_encoding ;mbstring.internal_encoding = » ʮmbstring.internal_encodingͱ͔࣌୅஗Εɺ ࣌୅͸default_charsetҰՕॴͰ͓̺!!!ʯ » ࢲʮ΁ʔͦ͏ͳΜͩʯ
  45. » ʮʢdefault_charset͸ʣ mbstring.internal_encoding ͕ະઃఆ ͷ৔߹ͷσϑΥϧτͱͯ͠΋༻͍ΒΕ·͢ʯ » ΁ʔɺ͍͢͝ɺָͰ͍͍Ͷʂ » ͕ʂ࢒೦ʂ »

    SJIS-win͸ɺೖΕͯ΋൓ө͞Εͳ͍ʂʢίϝϯτʹ΋ॻ͍ͯ͋Δʣ » eucJP-win΋μϝͬΆ͍ʂ » UTF-8ͳΒɺͦ΋ͦ΋σϑΥϧτ΍Ζ͕͍ » ʮ…·ɺੲͳ͕Βʹઃఆ͠·͢Θɺ৴༻Ұ൪ʯ
  46. » max_input_time » ʮεΫϦϓτ͕ POSTɺGET ͳͲͷೖྗΛ ύʔε͢Δ࠷େͷ࣌ؒΛɺ ඵ୯ҐͰࢦఆ͠·͢ɻ ͜Ε͸ɺαʔόʔଆͰ PHP

    ͕ىಈ͔ͯ͠Βε ΫϦϓτͷ࣮ߦΛ։࢝͢Δ·Ͱͷ࣌ؒͰ͢ɻʯ » Α͘Θ͔ΒΜͶʁਖ਼௚Զ΋Α͘Θ͔ΒΜ » େ఍͜Ε͸΋ͬͱ΁Βͤ·͢ » ʮ͜ΕηΩϡϦςΟͳͷʁʯʮ͏ʔΜ…͍ΕΔॴ͕…ʯ
  47. » max_input_vars = 1000 » POST΍GETͷΫΤϦύϥϝλͷ࠷େ਺ » 1000Λଟ͍ͱΈΔ͔গͳ͍ͱΈΔ͔ɺਓʹΑ༷ͬͯʑͰ͠ΐ͏ɺͲ ͏Ͱ͔͢ʁ »

    1000ͰͨΓͳ͍͜ͱ͸͋Δʢਅإʣ » ओʹDoSରࡦ͕ϕʔεʢϋογϡίϦδϣϯ߈ܸͱ͔ʣ » ௒͑ΔͱʁWARN͕Ͱͯɺ੾ΓࣺͯΒΕͯɺ࣮ߦ͸ਐߦ͢Δʢ஫ҙʣ
  48. » open_basedir = /var/www/html:/tmp » phpίʔυ্͔Β͸ࢦఆ͞Εͨpathͷ֎ΛಡΈॻ͖Ͱ͖ͳ͍Α͏ʹ » ʮ҆શͦ͏ͩʂ͜Ε͸PHPքͷSELinux͔ʂ!ʯ » ʢͭ·Γɺ͙͢ʹΦϑʹ͞Ε·͢ʣ

    » ʢ͔͠΋ɺPHP_INI_ALLͰ͢ʣ » ෳ਺ࢦఆ࣌͸PathΛ:Ͱͭͳ͙͕ɺWinͷ৔߹͸;Ͱͭͳ͙ » Ұจࣈͷ୅ΘΓʹɺ௕͍PATH_SEPARATORఆ਺Λ͔ͭ͑͹ղܾ
  49. » allow_url_fopen = On » $html = file_get_contents('https://example.com/'); » ΛڐՄ͢Δ͔

    » ڐՄ͠·͠ΐ͏! » ʢ͜Ε͕Ͱ͖ͳ͔ͬͨΒͳͥPHPΛ͔͍ͭͬͯΔͷ͔ٙ໰Λ๊͍ͯ͠ ·͏…ʣ
  50. » allow_url_include = Off » require ('http://example.com/super_lib.php'); » ΛڐՄ͢Δ͔ɻ »

    ʮϠόͳ͍ʁ!ʯʮωοτ͔ΒίʔυDLͱ͔Ҿ͘Θ"ʯ » curl https://hoge/installer.sh | bash ͬͯ΍ͬͨ͜ͱ͕ͳ͍ਓ͸ͦ͏ݴͬͯ΋ྑ͍ » Ͱ΋·͊ɺແ͍Θʔ
  51. » sql.safe_mode = Off » ʮ໊લ͔Βͯͭ͠Αͦ͏ʂ!ʯ » ͔͠͠ʮPHPͰ͍͏ͱ͜Ζͷsafe_modeʯͱ͍͏ҙຯͰ͋Γɺผʹ safeͰ͸ͳ͍" »

    ʮΦϯʹ͢ΔͱɺσϑΥϧτ஋͕ࢦఆ͞Ε͍ͯΔσʔλϕʔε઀ଓؔ ਺͸ɺ Ҿ਺Ͱࢦఆ͞Εͨ஋ΑΓ΋σϑΥϧτ஋Λ༏ઌͯ͠࢖༻͠· ͢ɻ ʯ » ʢphpʹ͓͚Δʮsafe modeʯͱ͸ɺϢʔβʔͷϙΧʢ΍ѱҙʣΛଟ গअຐ͢Δͱ͍͏ҙຯͰ͢ʣ
  52. » expose_php = On » X-Powered-By: PHP/7.0.9 ͳͲΛӅ͢ » ·͋Φϑʹ͍ͨ͠ਓ͸Φϑʹͨ͠΄͏͕ΑΖ͍͠

    » ʢϔομʔʹPHP͔͍ͬͯͯ͋Δͱ͏Ε͍͔͠Β൱ఆͮ͠Β͍ʣ » ෭࡞༻ͱͯ͠ɺʮΠʔελʔΤοάʯ͕͔ͭ͑ͳ͘ͳΓ·͢
  53. » ΋͸΍ςϯϓϨɺSessionͰCookieΛ࢖͏֤छઃఆ session.use_cookies = 1 ; SIDΛCookie͔ΒಡΊΔΑ͏ʹ session.use_only_cookies = 1

    ; ͍·Ͳ͖URLʹຒΊࠐ·ͳ͍ͷͰɺOn session.name = PHPSESSID ; CookieΩʔ໊ session.cookie_secure = 1 ; httpsͰͷΈηογϣϯͷCookieΛ΍ΓͱΓ session.cookie_domain = ; ະࢦఆͰݱࡏͷυϝΠϯʹͳΔͷͰɺ௨ৗෆཁ session.cookie_path = / ; ηογϣϯΫοΩʔͷPath session.cookie_httponly = 1 ; SIDΛJS͔Βݟ͑ͳ͘͢Δ session.use_strict_mode = 1 ; SIDΛ஫ೖͤ͞ͳ͍
  54. session.cookie_lifetime = 0 ; ηογϣϯΫοΩʔͷExpireΛࢦఆ » 0͸ϒϥ΢βΛด͡Δ·Ͱ༗ޮ » ʢݱ୅Ͱʮϒϥ΢βΛด͡Δʯͱ͸…ʁʣ »

    sessionΛҡ࣋͢Δʹ͸ɺద੾ʹઃఆ͢Δ » ʮࠓ͔ΒNඵʯ » ผ్ɺετϨʔδͷlifetimeͷઃఆ΋͍Δʢޙड़ʣ » ʮ௕͔͋͘͞Δ΂͠ʯͷٞ࿦͸͜͜Ͱ͸͠ͳ͍
  55. ηογϣϯIDͷੜ੒खஈؔ܎ » ηΩϡϦςΟʹίμϫϦ͕͋ΔͳΒม͑ͯ΋Α͍ͷͰ͸ » มߋ͢Δͱɺݱࡏͷશηογϣϯ͕ফ͑·͢ʢ౰ͨΓલ͕ͩ…ʣ session.hash_function = 1 ; ηογϣϯͷϥϯμϜจࣈͷ௕͞

    ; 0:md5͔1:sha1͔ࢦఆͰ͖Δɺ͚Ͳ7.1Ͱফ͑·ͨ͠ session.entropy_length = 32 ; PHP 7.1Ͱফ͑·ͨ͠ session.entropy_file = /dev/urandom ; PHP 7.1Ͱফ͑·ͨ͠
  56. ͳ͓ɺphp7.1͸͜ͷΑ͏ʹγϯϓϧʹͳͬͨ » php.iniͷσϑΥϧτͩͱޙํޓ׵ੑͷͨΊʹ26จࣈʹͳ͍ͬͯΔ ͕ɺ΋ͬͱͷ͹ͨ͠΄͏͕͍͍ͧͱ͍͏͜ͱΒ͍͠ɻ ; Shorter length than default is

    supported only for compatibility reason. ; Users should use 32 or more chars. ; Default Value: 32 ; Development Value: 26 ; Production Value: 26 session.sid_length = 26
  57. session.save_handler = files ; σϑΥϧτͷfileετϨʔδΛ࢖͏ session.save_path = "/tmp" ; fileετϨʔδͷઃఆͰɺͲ͜ʹ৘ใΛอଘ͢Δ͔

    » session.save_pathʹ͸ηογϣϯ৘ใ͕อଘ͞ΕͨେྔͷϑΝΠϧ ͕Ͱ͖Δ » अຐͩͱ͔ɺCronͰ૟আ͞Εͳ͍Α͏ʹͱ͔ɺnfsͰڞ༗͍ͨ͠ ͱ͔(ݹ)ɺඞཁ͕͋Ε͹มߋ͢Δ » ʢύʔϛογϣϯʹ஫ҙʂʣ » ʮPHPҎ֎ͰɺηογϣϯϑΝΠϧΛࣗલͰಡΈॻ͖͢ΔʯͳͲ ͱ͍ͬͨɺڧ·ͬͨΞϓϦΛॻ͘ͳΒ͜ͷpathΛ֬ೝ͢Δ
  58. » $_SESSIONΛγϦΞϥΠζ͢ΔϋϯυϥΛࢦఆ » ʮมߋ͢Δͷʁڧ͍Ͷʙʯ session.serialize_handler = php ; $_SESSIONΛԿͰγϦΞϥΠζ͢Δ͔ ;

    ଞʹphp_serializeͳͲ͕͋Δ ;session.lazy_write = On ; 7͔Βɺߋ৽͕͋Δ৔߹ͷΈॻ͖ࠐΉࣄͰੑೳ޲্ » ղͬͯΔਓ͚͕͍ͩ͡Δ߲໨Ͱ͢
  59. » ηογϣϯͷ༗ޮظؒؔ࿈ » gc_maxlifetimeɺσϑΥϧτͷ24෼͸୹͍Α͏ͳɺ௕͍Α͏ͳ… session.gc_maxlifetime = 1440 ; ηογϣϯ༗ޮظؒɺඵ ;

    ΞΫηεຖʹgc_probability/gc_divisorͷαΠίϩΛৼΓɺ ; ֬཰తʹsessionͷGCཁٻ͕ߦΘΕΔ session.gc_probability = 1 session.gc_divisor = 1000
  60. » ݬͷػೳɺupload_progress ;session.upload_progress.enabled = On ;session.upload_progress.cleanup = On ;session.upload_progress.prefix =

    "upload_progress_" ;session.upload_progress.name = "PHP_SESSION_UPLOAD_PROGRESS" ;session.upload_progress.freq = "1%" ;session.upload_progress.min_freq = "1" » ͳΜͱʮϑΝΠϧΞοϓϩʔυͷϓϩάϨεόʔʯΛग़ͤΔ » ΞοϓϩʔυதʹผͷϦΫΤετΛඈ͹ͯ͠ɺηογϣϯΛݟΔͱɺ ਺஋͕औΕΔ » ਅ໘໨ʹ͔ͭͬͨ͜ͱ͸ͳ͍
  61. » ʮͳΜͱʂදʹೋճొ৔͠·͢ʂʯ » ͖ͬͱॏཁ͔ͩΒͳΜͰ͠ΐ͏ʂ » ʢ͔ͭͬͨ͜ͱͳ͍ʣ » ʮ·ͨɺPHP 7.1.0 Ͱ࡟আ͞Ε·ͨ͠ɻʯ

    » ʮ͑ʁphp.iniϑΝΠϧʹ࢒ͬͯΔΜ͚ͩͲ…ʯʢini_get͸Ͱ͖·ͤ ΜͰͨ͠ʣ » ʢ㙽ʹ֯·͋ɺͦΜͳ͔͍͋ͭͩͱ͍͏͜ͱͰ͢Ͷʣ
  62. ; -1 ίϯύΠϧ࣌ແࢹɺ0 ࣮ߦ͠ͳ͍ɺ1 ࣮ߦ͢Δ zend.assertions = -1 ;assert.exception =

    On ; fail࣌ྫ֎(ʁ)εϩʔ ; ͜ΕҎԼ͸ԼҐޓ׵ੑͷͨΊ࢒͍ͬͯΔ͕ɺ͔ͭ͏ͳͱ ;assert.active = On ;assert.warning = On ;assert.bail = Off ;assert.callback = 0 ;assert.quiet_eval = 0
  63. curl.cainfo=/path/to/cacert.pem » SSL certificate problem: unable to get local issuer

    certificateΈ͍ͨͳΤϥʔ͕ग़ͨΒରԠ » ূ໌ॻ͸ݕূͯͦ͜͠ɺCURLOPT_SSL_VERIFYPEERΛfalseʹ͢Δͱ͔ μϝઈର » cacert.pem͸https://curl.haxx.se/ca/cacert.pemͳͲ͔Βೖख
  64. DB

More Decks by uzulla

Other Decks in Programming