Preventing version Leakage when using Dokuwiki

As if not updating my blog for months at time wasn’t enough, I also maintain a wiki that gets even less attention :(

The software powering the wiki is Dokuwiki – a fantastic wiki software that’s very feature-rich (thanks to a plugin architecture) but very lightweight (everything is maintained in text files!)

There is however one mild annoyance – Dokuwiki insists on adding a Meta-header advertising the version number and there’s no direct way of turning this off:

dokuwiki-version

Luckily there’s a plugin that can help – the metaheaders plugin. Unfortunately, the plugin does not ship with a configuration UI and the documentation on the plugin page is sparse. In order to disable the “generator” meta that Dokuwiki adds, here’s what you need to do:

1. Create a file called metaheaders.conf.php in the Dokuwiki conf directory. If you are using the dokuwiki package in Debian, the metaheaders.conf.php needs to go into the /etc/dokuwiki directory.

2. Add the following lines to the metaheaders.conf.php file:

<?php
$clear[] = array ( 'name' => 'generator' );

3. Clear the dokuwiki cache – you can do this by issuing a touch command on each txt file in the pages directory under /path/to/dokuwiki/data/pages (or /var/lib/dokuwiki/data/pages in Debian). Or, you can take the nuclear option and remove the cache directory entirely (/var/lib/dokuwiki/data/cache in Debian). Either way, once you’ve done this – you can trigger a full refresh of the page in your browser and check the page headers:

dokuwiki-noversion

Preventing Version Info Leakage with Dotdeb’s PHP 5.3.2 for Debian

There are plenty of arguments for and against Security Through Obscurity – I’m of the opinion that while the benefit for doing it might be slim, actually implementing it doesn’t cause any problems, so why not?

Moving On! The fastest way to upgrade the PHP version on Debian/Lenny “stable” without running into dependency hell is through the dotdeb repositories. Not only does it allow you to upgrade to PHP 5.3.2, you also get the ability to install PHP-FPM through the Debian package manager, instead of having to re-compile PHP from source.

There is one small problem though – once you upgrade using the Dotdeb repository, all your PHP pages have an “X-Powered-By” header included:

header-versionleak

If you are serving PHP content using Apache/2 alone, fixing this is relatively simple. Enable mod_headers as follows:

a2enmod headers

Then add the following line to your Virtual Host definition:1

RequestHeader unset X-Powered-By

Now reload your Apache configuration and the header information should disappear when you do a full refresh of the page in your browser.

On the other hand, it becomes a little more complicated if you are using Nginx as your public web-server and proxying PHP requests to a backend Apache process. Depending on how your Nginx setup is configured to handle PHP requests, you may need to use one of two approaches:

Approach 1 – Nginx directly serves PHP content by proxying to a PHP/FastCGI server

If you have installed PHP-FPM, you will know that it runs as a service listening for any requests on Port 9000. Hence, you could have Nginx serve PHP content using the following directives:

location ~* ^.*\.php$ {
fastcgi_pass   localhost:9000;
fastcgi_param  SCRIPT_FILENAME  /var/www/mywebsite/$fastcgi_script_name;}

To hide your PHP version, add the following directive to the Nginx configuration:

#Prevent version info leakage
fastcgi_hide_header X-Powered-By;

Approach 2 – Nginx serves PHP content by proxying to an Apache process:

In this approach, the Nginx configuration for serving PHP content looks very different from Approach 1:

location ~* ^.*\.php$ {
proxy_pass http://127.0.0.1:80;
}

The directive for hiding the version information also changes as Nginx is now acting as reverse-proxy:

#Prevent version info leakage
proxy_hide_header X-Powered-By;

Reload your Nginx configuration and check that the changes have taken effect by triggering a full refresh of the page in your browser:

header-noversion

  1. Note: I don’t use Apache as my front-end web server anymore so this isn’t tested by me. That said, it should work []

Firmware upgrades for the BlueAngel Q7 – A HowTo

At COMEX 2009, I picked up a Chinese-made set-top media player, called the Q7. Made by a company called Blue Angel, the tiny box packs in an amazing feature set:

  • Supports RMVB,AVI,DIVX,MKV,MOV,HDMOV,MP4,M4V,PMP,AVC,FLV,VOB,MPG,DAT,MPEG file formats
  • Does HDMI Output upto 720P
  • Built-in Flash memory of 2GB and USB-Host Support

The feature I was most intrigued by however, was a note buried in the instruction manual – it claimed that the manufacturer would provide firmware upgrades for the device!

Since this a device manufactured in China, even finding the manufacturer’s website took some digging around. Eventually, I did locate the site and after viewing it through Google Translate, I was able to download the upgrade installer. Awesome right?

Well not quite – as I had to go through quite a few hoops to actually get the installer to actually run. I figured that I might as well put down the steps on the Web for other folks who might be having the same problems as I did.

OS Compatibility Warning: The installer simply does not work under Vista. Trying XP Mode etc. on Vista is of no use. I have no idea whether it will work under Wine/Linux but for now I recommend sticking to Windows XP.

1. The latest firmware upgrade for the Q7 can be found here. Scroll down and look for the link text in green (or you can try this direct link, but I have no idea how long it will work)

2. The site is a bit slow, so be prepared to wait 15-20 mins for the file to download, even on a broadband connection.

3. Once you have extracted the files, you will wind up with a set of folders like so:

initial-folders

4. Extract the 2nd set of RAR files and we get the following:

second-extract

5. If you are on a English-language version of Windows, the Mandarin characters can cause a lot of problems with launching the installer. I recommend renaming the files to something like “q7upgrade.img” or the like.

6. I also suggest placing the files under the root of C: drive or some partition. It definitely won’t work with folder names containing spaces. Here’s the folder structure that worked for me:

moved_renamed

7. Next you need to launch the installer application. The 2nd round of RAR file extraction would have created a folder and a disk image. Look for an application called “LiveSuit.exe” in the folder:

livesuit

8. When you launch LiveSuit.exe, you will get the following window:

livesuit-exe

Note: If you would like to see the actual Mandarin characters used in the installer and get a translation of what they mean, please see Ashwin Nanjappa’s comment on how to enable Chinese character support & translations in Windows. Thanks Ashwin!

9. Click on the first icon (a packing box?) and locate the IMG file that you had extracted earlier. Once you do this, the second “gear” icon becomes active:

livesuit-gears

10. Now plugin the Q7 into your PC. It will be recognized in Windows as a USB 2.0 Flash Device

q7-usb

11. Once you get the “Hardware installed” popup in Windows, click on the gears icon in the LiveSuit app (Step 9 above)

12. You get a prompt of which very little is readable, except for one very important button:

Press Yes. What's the worst that could happen?

13. You will now be prompted to install drivers for the device. The USB Drivers are located in a subfolder inside the folder you launched the Livesuit installer from, i.e:

drivers

Once you have navigated to the correct folder with the drivers, your “install drivers wizard” should look like this:

hardware-wizard

14. You might have to run the Driver install wizard twice before the actual upgrade starts. Once the Driver install completes, the LiveSuit installer takes over:

upgrade-in-progess

15. Eventually, you get another unintelligible popup:

Not much choice here eh?

16. At this point, you have upgraded your Q7’s firmware – Congratulations! What do you get from this you might ask? Well the highlights are:

  • Proper resume from Standby when using the power button on the remote
  • Support for SUB format subtitles
  • Better MKV Support
  • Support for UTF-8/UTF-16 encoded subtitles.

Not bad at all eh? The entire release note is available on the webpage where the firmware is hosted, but you will have rely on Google Translate if you can’t read Mandarin – here’s a translated link

Post-Firmware Upgrade Warning:

  • After the upgrade, the On-Screen menus default to Mandarin again. You will have to go into the Settings menu and select the “Globe” icon to be able to change the language back to English.

16. If you are wondering how to exit the LiveSuit application, here’s a hint – it isn’t the regular close button on the App window. Instead you need to click the little running man/AIM icon:

oh that's so obvious

That’s the HowTo. Let me know in the comments if this helps or you have any problems. Happy Viewing!