php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #49650 Source code is sometimes sent to the browser
Submitted: 2009-09-24 08:30 UTC Modified: 2009-10-02 01:00 UTC
Votes:2
Avg. Score:5.0 ± 0.0
Reproduced:2 of 2 (100.0%)
Same Version:1 (50.0%)
Same OS:1 (50.0%)
From: michkol at gmail dot com Assigned:
Status: No Feedback Package: Apache2 related
PHP Version: 5.2.11 OS: Linux
Private report: No CVE-ID: None
View Developer Edit
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: michkol at gmail dot com
New email:
PHP Version: OS:

 

 [2009-09-24 08:30 UTC] michkol at gmail dot com 
Description:
------------
PHP responds to some invalid POST requests with an error message that includes the source code.


Reproduce code:
---------------
<?php
$dblogin = 'admin';
$dbpass = 'secret';
mysql_connect('localhost', $dblogin, $dbpass);
echo 'some output';
?>


$ telnet localhost 80
POST /test.php HTTP/1.0
Content-Length: -75000000



Expected result:
----------------
The code of a script should be never sent to clients. This is a severe security flaw.

Apache/PHP should just send a 413 error, without the code, for example:
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>413 Request Entity Too Large</title>
</head><body>
<h1>Request Entity Too Large</h1>
The requested resource<br />/test.php<br />
does not allow request data with POST requests, or the amount of data provided in
the request exceeds the capacity limit.
</body></html>


Actual result:
--------------
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>413 Request Entity Too Large</title>
</head><body>
<h1>Request Entity Too Large</h1>
The requested resource<br />/test.php<br />
does not allow request data with POST requests, or the amount of data provided in
the request exceeds the capacity limit.
</body></html>
<?php
$dblogin = 'admin';
$dbpass = 'secret';
mysql_connect('localhost', $dblogin, $dbpass);
echo 'some output';
?>

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2009-09-24 08:43 UTC] jani@php.net 
Sometimes? What PHP version are you really using?
 [2009-09-24 08:45 UTC] michkol at gmail dot com 
PHP 5.2.11, Apache 2.2.11.
 [2009-10-02 01:00 UTC] php-bugs at lists dot php dot net 
No feedback was provided for this bug for over a week, so it is
being suspended automatically. If you are able to provide the
information that was originally requested, please do so and change
the status of the bug back to "Open".
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved. 		Last updated: Sun Aug 17 10:00:03 2025 UTC