php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #38040 php_self incorrect in cgi mode
Submitted: 2006-07-08 19:37 UTC Modified: 2006-07-23 12:45 UTC
Votes:1
Avg. Score:5.0 ± 0.0
Reproduced:1 of 1 (100.0%)
Same Version:1 (100.0%)
Same OS:1 (100.0%)
From: php at jon dot limedaley dot com Assigned:
Status: Not a bug Package: CGI/CLI related
PHP Version: 5.2.0 OS: Debian Linux testing
Private report: No CVE-ID: None
View Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
If you reported this bug, you can edit this bug over here.
(description)
Block user comment
Status: Assign to:
Package:
Bug Type:
Summary:
From: php at jon dot limedaley dot com
New email:
PHP Version: OS:

 

 [2006-07-08 19:37 UTC] php at jon dot limedaley dot com
Description:
------------
This is a duplicate of #31892, but I am not sure if anyone will see that old bug?  I don't know the code well enough to know if that patch submitted is perfectly fine to include in the main code.  Can someone check to see if it looks alright?

I am unable to use php5 in cgi mode due to php_self not being correctly reported.

I can provide an example or a login if it is unclear what is happening.

I see Bug #31843, but I don't understand the response.  I should just change all scripts to not use $php_self?  I guess I could make my own php_self my appending $SCRIPT_FILENAME.$PATH_INFO?  Is there any reason why this isn't fixed? ie. does anyone use PHP_SELF in its current form, who would notice if it was changed back to its old behavior?

Reproduce code:
---------------
echo $_SERVER['PHP_SELF']

Expected result:
----------------
the actual script path.

Actual result:
--------------
NULL

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2006-07-08 20:09 UTC] tony2001@php.net
var_dump($_SERVER); ?
 [2006-07-08 20:35 UTC] php at jon dot limedaley dot com
var_dumps can be found here:
http://jon.limedaley.com/misc/test.php
http://jon.limedaley.com/misc/test.php5
http://jon.limedaley.com/misc/test.php/asd
http://jon.limedaley.com/misc/test.php5/asd

I have been working on seeing if there was a workaround for this, and it now seems that php5 is alright, but php4 has the wrong data.  I am quite confused, as I looked at this a week or two ago and the behavior was different.  There was a debian upgrade to php4 recently, but I didn't see anything interesting in the changelog.

cgi.fixpathinfo is not defined for php4 or php5, which I think defaults to 0 for php4 and 1 for php5?

Does php_self and path_info look how you think it should for the four URLs above?

I think they look alright for php5, but test.php/asd seems to have php_self set incorrectly?
 [2006-07-08 20:47 UTC] tony2001@php.net
>now seems that php5 is alright
Then please change the version in the report and try 4.4.x snapshot from http://snaps.php.net instead of some third-party build.
 [2006-07-09 00:17 UTC] php at jon dot limedaley dot com
Ok, I got the 5.2.0 snapshot as you requested.

It still seems broken to me if cgi.fix_pathinfo is turned on, which I believe is the default, and necessary to make $_SERVER['PHP_SELF'] return the correct value.

Is it correct for PATH_INFO to be not defined, when ORIG_PATH_INFO was correct?

Looking at the source, it seems that PATH_INFO is miscalculated because PATH_TRANSLATED is incorrect?  But, I am not at all sure what PATH_TRANSLATED is supposed to be.

See here:
http://jon.limedaley.com/misc/test.php5/asd

What do you think
PHP_SELF
PATH_INFO
PATH_TRANSLATED
should be?
What if cgi.fix_pathinfo were not defined, then what should those values be?

Maybe I am just not understanding how it is designed to work.
 [2006-07-16 00:47 UTC] php at jon dot limedaley dot com
I have reverted to the debian install package since I haven't heard anything.  Should be pretty easy to reproduce. If you want any help debugging it, you can let me know.
 [2006-07-19 22:51 UTC] sniper@php.net
Read the php.ini-dist and search the cgi.* entries. This is not a bug.
 [2006-07-20 00:30 UTC] php at jon dot limedaley dot com
What line are you referring to?  I assume you are talking about cgi.fixpathinfo, but that isn't included in the dist in 5.2.

~/php5.2-200607082030>grep cgi php.ini-dist
; cgi.force_redirect configuration below
; cgi.force_redirect is necessary to provide security running PHP as a CGI under
; cgi.force_redirect = 1
; if cgi.nph is enabled it will force cgi to always sent Status: 200 with
; cgi.nph = 1
; if cgi.force_redirect is turned on, and you are not running under Apache or Netscape
; cgi.redirect_status_env = ;
; security context that the request runs under.  mod_fastcgi under Apache
; fastcgi.impersonate = 1;
; fastcgi.log = 0
; cgi.rfc2616_headers configuration option tells PHP what type of headers to
;cgi.rfc2616_headers = 0


The behavior of fixpathinfo = 1 (I believe this is the recommended setting, right?) doesn't do what I think it should.  I was asking for confirmation that you want PATH_INFO to be null. ORIG_PATH_TRANSLATED is strange, I don't have any idea what that would be used for.

ORIG_PATH_INFO looks good, and what I would have expected PATH_INFO to be set to.

I wouldn't expect ORIG_PATH_INFO to be used for "real" scripts, ie. I shouldn't check it into the OSS packages I work on.

Can you tell me what you would expect PHP_SELF and PATH_INFO to be in this URL:
http://jon.limedaley.com/misc/test.php5/asd

I think it should be:
PHP_SELF: /misc/test.php5
PATH_INFO: /asd

instead of
PHP_SELF: /misc/test.php5
PATH_INFO: NULL
with fixpathinfo=1

and
PHP_SELF: /asd
PATH_INFO: /asd
with fixpathinfo=0

Do you agree?
 [2006-07-23 12:45 UTC] sniper@php.net
See also bug #31892 (yes, we can still see it..)
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Thu Oct 31 23:01:28 2024 UTC