Suhosin 0.9.15 comes with Transparent phpinfo() Protection

Tuesday, November 28. 2006

During the last weeks several people blogged about open phpinfo() pages (here and here). They usually contain a lot of information about the server and therefore should not be open to the public and especially not to search engines like Google that will keep them for a long time in their archive.

Because of this the Suhosin extension does now add an extra META TAG to the HTML output of phpinfo() that forbids indexing and archiving by robots. For fairness reasons following the embedded links is still allowed to robots, because a lot of projects like dotdeb and suhosin add links within phpinfo() to their project site to get atleast a few backlinks for their work, that might result in a better search engine positioning.

Future versions of PHP will come with a similiar META TAG by default that also forbids following the backlinks. Suhosin will correct this on the fly. Ironically those in favor of disallowing backlinks from within phpinfo(), are those developing PHP applications that contain similiar backlinks on every page.

Posted by Stefan Esser in Security, PHP at 20:48

Comments (6)

Link to this post

Comments

Display comments as (Linear | Threaded)

#1 Jacques Marneweck wrote (Link) ()

Now to get Suhosin enabled by default on more OS's

I wonder if I should bring this up on internals.

posted on Tuesday, November 28. 2006

#2 Slappy ()

Finally someone names the Robto Meta Tags in public as a kind of solution, thanks!

posted on Tuesday, November 28. 2006

#2.1 Stefan Esser wrote (Link) ()

Well I don't see this as a solution. It is just a way to stop nice behaving robots from indexing the page.

The problem of open phpinfo() pages is not gone because of this and I am pretty sure someone will come up with ways to abuse google or other search engines so that it is still possible to find phpinfo() pages. By using links or by other means, that might require a lot of traffic (like beeing a transparent proxy)

posted on Wednesday, November 29. 2006

#3 Aaron Wormus wrote (Link) ()

If the page has noindex and noarchive headers then it will never get any PR, and will therefore not have any to pass on to its links. You cant squeeze blood out of a turnip.

I don't see why they are putting nofollow tags in PHP HEAD.

posted on Wednesday, November 29. 2006

#4 Stefan Esser wrote (Link) ()

Aaron, it depends on who you ask. Some people claim that it will get a Page Rank relative to the one the indexed page would have. Some other claim you don't get anything from this.

However more links is always better than no links. So even when they are counted in as 0 PR links, they are still links. And Google is not the only search engine.

posted on Wednesday, November 29. 2006

#4.1 Aaron Wormus wrote (Link) ()

> And Google is not the only search engine.

True

posted on Wednesday, November 29. 2006

Add Comment

Name:

Email:

Homepage:

In reply to:

Comment:
Standard emoticons like :-) and ;-) are converted to images.

Remember Information? Subscribe to this entry
Submitted comments will be subject to moderation before being displayed.

Calendar