php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Request #20891 Misuse PATH_INFO, PATH_TRANSLATED environment variables in CGI, Fastcgi SAPI
Submitted: 2002-12-08 20:14 UTC Modified: 2002-12-08 22:27 UTC
From: gangwang at optonline dot net Assigned:
Status: Closed Package: Feature/Change Request
PHP Version: 4.2.3 OS: Linux
Private report: No CVE-ID: None
View Developer Edit
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: gangwang at optonline dot net
New email:
PHP Version: OS:

 

 [2002-12-08 20:14 UTC] gangwang at optonline dot net 
I am writting a web server which can support PHP. 
I found the CGI and fastcgi SAPI modules misuse the PATH_INFO, PATH_TRANSLATED environment variables, at least I think they are.
I did the following test with apache-1.3.24:
I had phpinfo.php and php executable in cgi-bin directory:

$ more phpinfo.php 
#!./php
<HTML>
<BODY>
   <?php phpinfo() ?>
</BODY>
</HTML>

The request:
http://localhost/cgi-bin/phpinfo.php 
has no problem

The request:
http://localhost/cgi-bin/phpinfo.php/path/info  
will return 500 Internal server error
same thing will happen with fastcgi SAPI.

the second request will succeed with mod_php.

I read the code of CGI and fastcgi modules and found PATH_TRANSLATED is used as the path of php scirpt file when it exists, otherwise SCRIPT_FILENAME will be used. Then for the second request, the script file refered as PATH_TRANSLATED will not be found.
The PATH_INFO is not used in the right way too.
PATH_INFO is used as the request URI, if it exists, otherwise SCRIPT_NAME is used.

They are is not compliant with CGI 1.1 or 1.2 specification.
The right way to use those environment variables are:
reuqest URI = <REQUEST_URI> or <SCRIPT_NAME>+<PATH_INFO>
script_file_path = <SCRIPT_FILENAME>.
<PATH_TRANSLATED> should NOT be touched.
If <SCRIPT_FILENAME> does not exist, you can try to build the script_file_path from <DOCUMENT_ROOT>+<SCRIPT_NAME>, but that is not guaranteed to be correct.

Best regards,
Gang Wang

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2002-12-08 22:27 UTC] sniper@php.net 
This is actually fixed in CVS by Shane last week, iirc.
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved. 		Last updated: Thu Jul 17 12:01:33 2025 UTC