php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Request #20891 Misuse PATH_INFO, PATH_TRANSLATED environment variables in CGI, Fastcgi SAPI
Submitted: 2002-12-08 20:14 UTC Modified: 2002-12-08 22:27 UTC
From: gangwang at optonline dot net Assigned:
Status: Closed Package: Feature/Change Request
PHP Version: 4.2.3 OS: Linux
Private report: No CVE-ID: None
View Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
If you reported this bug, you can edit this bug over here.
(description)
Block user comment
Status: Assign to:
Package:
Bug Type:
Summary:
From: gangwang at optonline dot net
New email:
PHP Version: OS:

 

 [2002-12-08 20:14 UTC] gangwang at optonline dot net 
I am writting a web server which can support PHP. 
I found the CGI and fastcgi SAPI modules misuse the PATH_INFO, PATH_TRANSLATED environment variables, at least I think they are.
I did the following test with apache-1.3.24:
I had phpinfo.php and php executable in cgi-bin directory:

$ more phpinfo.php 
#!./php
<HTML>
<BODY>
   <?php phpinfo() ?>
</BODY>
</HTML>

The request:
http://localhost/cgi-bin/phpinfo.php 
has no problem

The request:
http://localhost/cgi-bin/phpinfo.php/path/info  
will return 500 Internal server error
same thing will happen with fastcgi SAPI.

the second request will succeed with mod_php.

I read the code of CGI and fastcgi modules and found PATH_TRANSLATED is used as the path of php scirpt file when it exists, otherwise SCRIPT_FILENAME will be used. Then for the second request, the script file refered as PATH_TRANSLATED will not be found.
The PATH_INFO is not used in the right way too.
PATH_INFO is used as the request URI, if it exists, otherwise SCRIPT_NAME is used.

They are is not compliant with CGI 1.1 or 1.2 specification.
The right way to use those environment variables are:
reuqest URI = <REQUEST_URI> or <SCRIPT_NAME>+<PATH_INFO>
script_file_path = <SCRIPT_FILENAME>.
<PATH_TRANSLATED> should NOT be touched.
If <SCRIPT_FILENAME> does not exist, you can try to build the script_file_path from <DOCUMENT_ROOT>+<SCRIPT_NAME>, but that is not guaranteed to be correct.

Best regards,
Gang Wang

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2002-12-08 22:27 UTC] sniper@php.net 
This is actually fixed in CVS by Shane last week, iirc.
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved. 		Last updated: Thu Jul 17 12:01:33 2025 UTC