During my clean install of v1.38, during my set-up check I received the message: PHP session.use_trans_sid=ON along with the link to the fix, which is to the page: http://www.olate.co.uk/articles/252

I chose the .htaccess fix which was to add the line:

php_flag session.use_trans_sid off

to my .htaccess file, which until the addition of that line was empty. The file is also one directory level above the store.

After I added the line to the file, i clicked on the recheck button, and was given a 500 error screen, which I just assumed was bcause I had added it in the middle of an install. So I closed my browser, re-opened it and began the install over again, or at least attempted to.

I was not allowed access to the install files. All I received were 500 errors and denied access. So I went back in via ftp and deleted the line from the .htaccess file and once again was able to access the install files.

Is this how it is supposed to work? Was I supposed to wait until after the install to add it?

thank you,

betty

Create a file called 'php.ini' and place the following in it.

session.use_trans_sid = off
register_globals = off

Now upload to the 'php.ini' file to the same place where you uploaded the "ipn_main_handler.php" file.

You should then be good to go (and more secure as well).

Will that disable any admin functions?

thank you,

betty

No.

Whether you turn them OFF or leave them ON is up to you, but there is a reason why they are mentioned in the Zen Cart setup.

Hi,
I had the same big RED X when doing my first (fresh) install of v.1.3.8

I uploaded an .htaccess file to correct it. Htaccess file includes this:

Fix certain PHP values

#<IfModule mod_php4.c>
php_flag session.use_trans_sid 0
php_value session.use_trans_sid 0
php_value register_globals 0
#</IfModule>
php_flag session.use_trans_sid off
php_value session.use_trans_sid off
php_value register_globals off
#php_value register_globals off
<Files ".ht*">
deny from all
</Files>

which SHOULD fix the warning about the session.use_trans_sid=ON, but does not.
Anyone have any other thoughts.

Oh, the php.ini idea above did not work for me.

the php.ini is used for servers that are running php as cgi since you cant place php over-ride directives in .htaccess files.

I don't know if this applies to your situation - but maybe it does.

We run our servers in "High Security" mode, which means that what you can do via .htaccess is limited. URL Rewriting is okay, but setting Register Globals on/off has to be done via a local php.ini file.

That's not just via any old php.ini file which the cistomer writes but a local server generated php.ini file which the site owner can access, download, edit and then upload again.

If you are using your own php.ini file which you created then look via FTP into the lowest of the directories (closest to root) you can access and see if there's a php.ini file there.

Vger

Geixa:

Hi,
I had the same big RED X when doing my first (fresh) install of v.1.3.8

I uploaded an .htaccess file to correct it. Htaccess file includes this:

Fix certain PHP values

#<IfModule mod_php4.c>
php_flag session.use_trans_sid 0
php_value session.use_trans_sid 0
php_value register_globals 0
#</IfModule>
php_flag session.use_trans_sid off
php_value session.use_trans_sid off
php_value register_globals off
#php_value register_globals off
<Files ".ht*">
deny from all
</Files>

which SHOULD fix the warning about the session.use_trans_sid=ON, but does not.
Anyone have any other thoughts.

Oh, the php.ini idea above did not work for me.

Hi all,
My hosting company does not allow me to access the root php.ini file to set globals.
They insist on doing this by way of .htaccess.
I also checked that Allowoverride was enabled an it is.

I just opened a trouble ticket with my hosting company.
They finally replied & it seems that the .htaccess file did turn the session.use_trans_sid OFF, but it didn't say that during install...

Here's what my hosting company sent to me proving the session.use_trans_sid was OFF:

In the two entries above that one both the local and master values are the same. It just seems odd that you have to use .htaccess to turn session.use_trans_sid to off

Vger