X-Git-Url: https://vcs.fsf.org/?p=squirrelmail.git;a=blobdiff_plain;f=INSTALL;h=06af96421fa46c57b454c42eb6c2d6c6d5746ead;hp=4117c2e0a0b0fa4cd51477ca80b59b2910fe4e67;hb=911ad01c6b8b6371fd07d6b6538da0b5160f74bb;hpb=45c0a3a3244029cd67921700cac367ba5ccbd4a5

diff --git a/INSTALL b/INSTALL
index 4117c2e0..06af9642 100644
--- a/INSTALL
+++ b/INSTALL
@@ -28,7 +28,26 @@ a. Obtaining and compiling PHP4
   You might also want to read the INSTALL file in the PHP-distribution
   :-)
 
-b. Setting up .php files to use PHP4
+b. Changing php.ini
+
+  PHP defaults to look for php.ini (PHP's configuration file) in
+  /usr/local/lib.  However, for security reasons, it is suggested
+  that the location of this file is changed to someplace else.  This
+  can be done at configure time with the configuration directive
+  --with-config-file-path=PATH.
+
+  Edit the php.ini file and make sure session.use_cookies is 1.  Also 
+  be sure to change the session.save_path to someplace that can only 
+  be read and written to by the webserver.  session.save_path is the
+  location that PHP's session data will be written to.
+
+  SECURITY WARNING - If a user has access to write PHP scripts on your 
+  system and knows the location where PHP stores session data, he 
+  could get a listing of the sessions being used and then read a given 
+  session's data with his own PHP script.  Caution should be used when 
+  setting up permissions and locations of php.ini and the session data.
+
+c. Setting up .php files to use PHP4
 
   You need to create a .htaccess file in you SquirrelMail directory
   that looks something like this:
@@ -38,7 +57,7 @@ b. Setting up .php files to use PHP4
 
   You could also add these lines to your Apache configuration file.
 
-c. Running into trouble
+d. Running into trouble
 
   Setting up Apache with PHP4 can be a non-trivial task. Read the PHP4
   and Apache documentation carefully if you run into trouble. If you
@@ -115,3 +134,10 @@ c. Setting up SquirrelMail
   Point your browser at the URL at which SquirrelMail is installed. It
   should be pretty stright forward to use. Some more documentation
   might show up onbe day or another.
+
+
+5. RUSSIAN CHARSETS
+-------------------
+
+  For information on how to make SquirrelMail work with Russian
+  Apache, see the README.russian_apache in the doc/ subdirectory.