updated info on php.ini

[squirrelmail.git] / INSTALL

diff --git a/INSTALL b/INSTALL
index 051779ce66413d39aa4fc7ea6367a76efa20b5dd..06af96421fa46c57b454c42eb6c2d6c6d5746ead 100644 (file)
--- a/INSTALL
+++ b/INSTALL
@@ -19,13 +19,35 @@ a. Obtaining and compiling PHP4
   If you have a database like MySQL you might want to add something
   like --with-mysql to get database functionality.
 
+  If you're going to use LDAP in the addressbook, you must compile PHP4
+  with --with-ldap (see the PHP4 docs for more information).
+
   Run make to build the binary file. This will generate a binary file
   called "php". Move this file into a CGI-directory.
 
   You might also want to read the INSTALL file in the PHP-distribution
   :-)
 
-b. Setting up .php files to use PHP4
+b. Changing php.ini
+
+  PHP defaults to look for php.ini (PHP's configuration file) in
+  /usr/local/lib.  However, for security reasons, it is suggested
+  that the location of this file is changed to someplace else.  This
+  can be done at configure time with the configuration directive
+  --with-config-file-path=PATH.
+
+  Edit the php.ini file and make sure session.use_cookies is 1.  Also 
+  be sure to change the session.save_path to someplace that can only 
+  be read and written to by the webserver.  session.save_path is the
+  location that PHP's session data will be written to.
+
+  SECURITY WARNING - If a user has access to write PHP scripts on your 
+  system and knows the location where PHP stores session data, he 
+  could get a listing of the sessions being used and then read a given 
+  session's data with his own PHP script.  Caution should be used when 
+  setting up permissions and locations of php.ini and the session data.
+
+c. Setting up .php files to use PHP4
 
   You need to create a .htaccess file in you SquirrelMail directory
   that looks something like this:
@@ -35,7 +57,7 @@ b. Setting up .php files to use PHP4
 
   You could also add these lines to your Apache configuration file.
 
-c. Running into trouble
+d. Running into trouble
 
   Setting up Apache with PHP4 can be a non-trivial task. Read the PHP4
   and Apache documentation carefully if you run into trouble. If you
@@ -112,3 +134,10 @@ c. Setting up SquirrelMail
   Point your browser at the URL at which SquirrelMail is installed. It
   should be pretty stright forward to use. Some more documentation
   might show up onbe day or another.
+
+
+5. RUSSIAN CHARSETS
+-------------------
+
+  For information on how to make SquirrelMail work with Russian
+  Apache, see the README.russian_apache in the doc/ subdirectory.