Take the 2-minute tour ×

At my server , the host provide some alternative PHP.ini configs .

The only one that has the Extension Zip (which I need) is described as :


Advanced settings for experienced users with: cgi.fix_pathinfo = 1 and Extension Zip Enabled

I am using the website primarily for wordpress , but I would like to know what are the possible effects (or meaning) of this .

from : http://www.php.net/manual/en/ini.core.php#ini.cgi.fix-pathinfo


searching for google provided only blurry results for me ,as well as directly asking the host (the call center girls do not really understand , and the tech guys are not responsive ..)

share|improve this question
add comment

1 Answer

up vote 2 down vote accepted

It seems that the ZIP extension expects the URL to be passed along as a PATH_INFO variable. CGI and FastCGI implementations of PHP do not have PATH_INFO available, so when trying to pass the URI along, PHP fails. One way around that is to set cgi.fix_pathinfo to true.

share|improve this answer
SO in other words, tgat particular pathinfo fix is neccessary for the ZIP extention to work.. But does it have any possible side effects ? –  Obmerk Kronen Apr 23 '13 at 23:56
I couldn't imagine any. –  ssergei Apr 24 '13 at 9:16
Well according to this digitalocean.com/community/articles/… cgi.fix_pathinfo = 1 poses a security risk, but I still don't know what the risk is –  bivoc Feb 23 at 15:05
@simON: If you have an image with embedded malicious PHP code, and upload it through a site that accepts images, to say /wordpress/content/image/badpicture.jpg And then try to navigate to /wordpress/content/image/badpicture.jpg/FakeFile.php, the PHP interpreter will get called, guess that you meant to run badpicture.jpg since it contains PHP code, instead of FakeFile.php which doesn't exist, and then you have bad PHP code that can do whatever PHP can do- ie a compromised server. –  Nick May 1 at 19:13
@Nick, nice explanation. But I think this security risk only exists on Nginx. If Apache is used as the web server, it should be OK. Am I right? –  skyfree May 28 at 3:26
show 1 more comment

Your Answer


