php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #27530 safe_mode breaks authorization via header() in 4.3.5RC2, too
Submitted: 2004-03-08 17:49 UTC Modified: 2004-03-08 21:16 UTC
Votes:1
Avg. Score:5.0 ± 0.0
Reproduced:1 of 1 (100.0%)
Same Version:1 (100.0%)
Same OS:1 (100.0%)
From: arekm at pld-linux dot org Assigned:
Status: Closed Package: Output Control
PHP Version: 4.3.4 OS: Linux 2.4/2.6 + glibc 2.3.2
Private report: No CVE-ID: None
View Developer Edit
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: arekm at pld-linux dot org
New email:
PHP Version: OS:

 

 [2004-03-08 17:49 UTC] arekm at pld-linux dot org 
Description:
------------
The problem is that when safe_mode = On and we have simple script:
<?php
  header('WWW-Authenticate: Basic realm=\"log in\"');
  header('HTTP/1.0 401 Unauthorized');
  exit;
?>
and I get
 3 Server: Apache/2.0.48 (Unix) mod_fastcgi/2.4.2 mod_ssl/2.0.48 OpenSSL/0.9.7c DAV/2
 4 X-Powered-By: PHP/4.3.5RC2
 5 WWW-Authenticate: 1000
which is unknown authentication method for any browser.

According to documentation (http://pl2.php.net/manual/en/features.safe-mode.functions.php) UID should be appended to user specified string.

Tested in on different setups like apache 1.3.29+php 4.3.3, php 4.3.4, apache 2.0.48+php 4.3.5RC2 in fastcgi mode, without fastcgi mode. Always reproducible.

Turning safe_mode = Off fixes problem of course.

Reproduce code:
---------------
See description.

Expected result:
----------------
 3 Server: Apache/2.0.48 (Unix) mod_fastcgi/2.4.2 mod_ssl/2.0.48 OpenSSL/0.9.7c DAV/2
 4 X-Powered-By: PHP/4.3.5RC2
 5 WWW-Authenticate: Basic realm=\"log in\"

+ somehwere UID since that's safe mode.

Actual result:
--------------
 3 Server: Apache/2.0.48 (Unix) mod_fastcgi/2.4.2 mod_ssl/2.0.48 OpenSSL/0.9.7c DAV/2
 4 X-Powered-By: PHP/4.3.5RC2
 5 WWW-Authenticate: 1000

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2004-03-08 21:16 UTC] iliaa@php.net 
This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved. 		Last updated: Thu Nov 21 17:01:32 2024 UTC