PHP :: Bug #27530 :: safe_mode breaks authorization via header() in 4.3.5RC2, too

Bug #27530

safe_mode breaks authorization via header() in 4.3.5RC2, too

Submitted:

2004-03-08 17:49 UTC

Modified:

2004-03-08 21:16 UTC

Votes:	1
Avg. Score:	5.0 ± 0.0
Reproduced:	1 of 1 (100.0%)
Same Version:	1 (100.0%)
Same OS:	1 (100.0%)

From:

arekm at pld-linux dot org

Assigned:

Status:

Closed

Package:

Output Control

PHP Version:

4.3.4

OS:

Linux 2.4/2.6 + glibc 2.3.2

Private report:

CVE-ID:

None

View Developer Edit

Anyone can comment on a bug. Have a simpler test case? Does it work for you on a different platform? Let us know!
Just going to say 'Me too!'? Don't clutter the database with that please !

Your email address: MUST BE VALID
Solve the problem: 3 + 44 = ?
Subscribe to this entry?

[2004-03-08 17:49 UTC] arekm at pld-linux dot org

Description:
------------
The problem is that when safe_mode = On and we have simple script:
<?php
  header('WWW-Authenticate: Basic realm=\"log in\"');
  header('HTTP/1.0 401 Unauthorized');
  exit;
?>
and I get
 3 Server: Apache/2.0.48 (Unix) mod_fastcgi/2.4.2 mod_ssl/2.0.48 OpenSSL/0.9.7c DAV/2
 4 X-Powered-By: PHP/4.3.5RC2
 5 WWW-Authenticate: 1000
which is unknown authentication method for any browser.

According to documentation (http://pl2.php.net/manual/en/features.safe-mode.functions.php) UID should be appended to user specified string.

Tested in on different setups like apache 1.3.29+php 4.3.3, php 4.3.4, apache 2.0.48+php 4.3.5RC2 in fastcgi mode, without fastcgi mode. Always reproducible.

Turning safe_mode = Off fixes problem of course.

Reproduce code:
---------------
See description.

Expected result:
----------------
 3 Server: Apache/2.0.48 (Unix) mod_fastcgi/2.4.2 mod_ssl/2.0.48 OpenSSL/0.9.7c DAV/2
 4 X-Powered-By: PHP/4.3.5RC2
 5 WWW-Authenticate: Basic realm=\"log in\"

+ somehwere UID since that's safe mode.

Actual result:
--------------
 3 Server: Apache/2.0.48 (Unix) mod_fastcgi/2.4.2 mod_ssl/2.0.48 OpenSSL/0.9.7c DAV/2
 4 X-Powered-By: PHP/4.3.5RC2
 5 WWW-Authenticate: 1000

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports

[2004-03-08 21:16 UTC] iliaa@php.net

This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.

	php.net \| support \| documentation \| report a bug \| advanced search \| search howto \| statistics \| random bug \| login
go to bug id or search bugs for


Copyright © 2001-2025 The PHP Group All rights reserved.	Last updated: Thu Nov 06 08:00:01 2025 UTC