php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #80113 .user.ini may not be applied in subdirectories if CONTEXT_DOCUMENT_ROOT is set
Submitted: 2020-09-16 21:09 UTC Modified: 2020-10-19 09:25 UTC
Votes:1
Avg. Score:4.0 ± 0.0
Reproduced:1 of 1 (100.0%)
Same Version:1 (100.0%)
Same OS:1 (100.0%)
From: mattr at wordfence dot com Assigned: nikic (profile)
Status: Closed Package: CGI/CLI related
PHP Version: 8.0.0beta3 OS: Linux
Private report: No CVE-ID: None
View Developer Edit
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: mattr at wordfence dot com
New email:
PHP Version: OS:

 

 [2020-09-16 21:09 UTC] mattr at wordfence dot com 
Description:
------------
The .user.ini file is no longer applied in subdirectories, when Apache is configured to serve PHP via CGI with configuration like this:
  ScriptAlias /local-bin /usr/local/bin
  AddHandler application/x-httpd-php-8-0 .php
  Action application/x-httpd-php-8-0 /local-bin/php-cgi

As far as I can tell, this is caused by the new handling of CONTEXT_DOCUMENT_ROOT in sapi_cgi_activate() in sapi/cgi/cgi_main.c.

Using phpinfo, I see that CONTEXT_DOCUMENT_ROOT is not where the php files are located:
  CONTEXT_DOCUMENT_ROOT: /usr/local/bin 
  DOCUMENT_ROOT: /home/user/public_html

When php_cgi_ini_activate_user_config() checks if the script is inside the document root, it is using the value from CONTEXT_DOCUMENT_ROOT, which doesn't match -- so it is no longer looking in parent directories for .user.ini files.

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2020-09-22 14:49 UTC] willypbender83 at gmail dot com 
This was introduced as a fix for https://bugs.php.net/bug.php?id=64865

What are you using CONTEXT_DOCUMENT_ROOT for? Not for UserDir module?
 [2020-09-22 14:57 UTC] mattr at wordfence dot com 
I'm actually not trying to use CONTEXT_DOCUMENT_ROOT for anything. Apache sets it when using this kind of CGI configuration, and after the change in 64865, PHP tries to use that to find .user.ini instead of the DOCUMENT_ROOT, which would be the correct path in this case.
 [2020-10-19 09:25 UTC] nikic@php.net
-Status: Open +Status: Closed -Assigned To: +Assigned To: nikic
 [2020-10-19 09:25 UTC] nikic@php.net 
I've reverted the CONTEXT_DOCUMENT_ROOT change for now, so this should be fixed.
 [2020-10-19 09:26 UTC] nikic@php.net 
Related To: Bug #64865
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved. 		Last updated: Thu Nov 21 20:01:29 2024 UTC