|
php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login |
[2009-01-08 20:04 UTC] sriram dot natarajan at sun dot com
Description:
------------
currently, php cgi sapi code checks for redirect url and env_path_translated to determine if the request is coming from apache web server and accordingly modifies the CGI environment variables so that server can continue processing.
however, this check is insufficient considering that any web server exporting SCRIPT_FILENAME and REDIRECT_URL with some value will be hit by the apache specific processing.
Reproduce code:
---------------
if (env_path_translated != NULL && env_redirect_url != NULL) {
/*
pretty much apache specific. If we have a redirect_url
then our script_filename and script_name point to the
php executable
*/
script_path_translated = env_path_translated;
/* we correct SCRIPT_NAME now in case we don't have PATH_INFO */
env_script_name = env_redirect_url;
}
Expected result:
----------------
server should continue processing
Actual result:
--------------
no input file is returned
PatchesPull RequestsHistoryAllCommentsChangesGit/SVN commits
|
|||||||||||||||||||||||||||||||||||||
Copyright © 2001-2025 The PHP GroupAll rights reserved. |
Last updated: Mon Nov 03 18:00:01 2025 UTC |
here is the suggested patch to address this issue --- sapi/cgi/cgi_main.c.ORIG Wed Jan 7 07:10:14 2009 +++ sapi/cgi/cgi_main.c Wed Jan 7 19:37:21 2009 @@ -960,16 +960,18 @@ TRANSLATE_SLASHES(env_document_root); } - if (env_path_translated != NULL && env_redirect_url != NULL) { - /* - pretty much apache specific. If we have a redirect_url - then our script_filename and script_name point to the - php executable - */ - script_path_translated = env_path_translated; - /* we correct SCRIPT_NAME now in case we don't have PATH_INFO */ - env_script_name = env_redirect_url; - } + if (env_path_translated != NULL && env_redirect_url != NULL && + orig_script_filename != NULL && script_path_translated != NULL && + strcmp(orig_script_filename, script_path_translated) != 0) { + /* + pretty much apache specific. If we have a redirect_url + then our script_filename and script_name point to the + php executable + */ + script_path_translated = env_path_translated; + /* we correct SCRIPT_NAME now in case we don't have PATH_INFO */ + env_script_name = env_redirect_url; + }previous patch had whitespaces instead of tabs causing the patch to appear distorted. posting a same patch with this issue addressed --- sapi/cgi/cgi_main.c.ORIG Thu Jan 8 14:18:25 2009 +++ sapi/cgi/cgi_main.c Thu Jan 8 14:18:31 2009 @@ -960,7 +960,9 @@ TRANSLATE_SLASHES(env_document_root); } - if (env_path_translated != NULL && env_redirect_url != NULL) { + if (env_path_translated != NULL && env_redirect_url != NULL && + orig_script_filename != NULL && script_path_translated != NULL && + strcmp(orig_script_filename, script_path_translated) != 0) { /* pretty much apache specific. If we have a redirect_url then our script_filename and script_name point to thehi this fix is not available with the latest php snapshot. my latest patch needs to be looked into and considered fixing it for 5.3 as well as 5.2.9 [sn123202@samp]'php5'>diff -u php-5.2.9/sapi/cgi/cgi_main.c.ORIG php-5.2.9/sapi/cgi/cgi_main.c --- php-5.2.9/sapi/cgi/cgi_main.c.ORIG Sat Feb 28 00:44:54 2009 +++ php-5.2.9/sapi/cgi/cgi_main.c Sat Feb 28 00:46:00 2009 @@ -961,7 +961,8 @@ } if (env_path_translated != NULL && env_redirect_url != NULL && - orig_script_filename != NULL && script_path_translated != NULL) { + env_path_translated != script_path_translated && + strcmp(env_path_translated, script_path_translated) != 0) { /* pretty much apache specific. If we have a redirect_url then our script_filename and script_name point to the thanks sriram