php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #21542 variables bad values - register_global - session
Submitted: 2003-01-09 06:23 UTC Modified: 2003-01-09 19:46 UTC
From: peton at cavalex dot com Assigned:
Status: Not a bug Package: Session related
PHP Version: 4.3.0 OS: Linux
Private report: No CVE-ID: None
View Add Comment Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
You can add a comment by following this link or if you reported this bug, you can edit this bug over here.
(description)
Block user comment
Status: Assign to:
Package:
Bug Type:
Summary:
From: peton at cavalex dot com
New email:
PHP Version: OS:

 

 [2003-01-09 06:23 UTC] peton at cavalex dot com
Hi,

a strange problem, with session and register_global.
The problem does not exist with PHP-4.2.3.

When you have a variable set to a undefined value of
$_SERVER array, and register_global set to ON, PHP set
all variables to the same value (the last value).
If you reload the page, there is no problem, it is only
the FIRST time you read the page where there is the
session variable is built.
If you try with an unset variable, there is no problem.

By the way, I don't understand the last message about
"Your script possibly relies on a session side-effect..."
when register_global is set to OFF.


Best Regards,

Nicolas



--- info PHP

 PHP Version 4.3.0
 register_argc_argv On
 session.auto_start  Off
 session.bug_compat_42  On
 session.bug_compat_warn  On
 session.cookie_domain  no value
 session.name  PHPSESSID
 session.use_cookies  On
 session.use_only_cookies  Off
 session.use_trans_sid  Off

-------------- test.php -------------
+++SCRIPT+++
session_start();
$referer=$_SERVER['HTTP_REFERER']; # ERR (first time)
#$referer="----"; # OK (always)
session_register("referer");

echo "<PRE>"; echo session_encode(); echo "</PRE>";

$var1="V1";
$var2="V2";
$var3="V3";
echo "<BR>$var1 -- $var2 -- $var3 -- $var_not_affected\n";
+++

------- WITH register_global : On
At the first execution of ths script:

+++OUTPUT+++
referer|N;


V3 -- V3 -- V3 -- V3
+++

AND after reload:

+++OUTPUT+++
referer|N;


V1 -- V2 -- V3 --
+++

------- WITH register_global : Off

+++OUTPUT+++
referer|N;


V1 -- V2 -- V3 --

Warning: Unknown(): Your script possibly relies on a
session side-effect which existed until PHP 4.2.3.
Please be advised that the session extension does
not consider global variables as a
source of data, unless register_globals is enabled.
You can disable this functionality and this warning
by setting session.bug_compat_42 or
session.bug_compat_warn to off, respectively. in
Unknown on line 0
+++

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2003-01-09 19:46 UTC] iliaa@php.net
Thank you for taking the time to write to us, but this is not
a bug. Please double-check the documentation available at
http://www.php.net/manual/ and the instructions on how to report
a bug at http://bugs.php.net/how-to-report.php

Set session.bug_compat_warn to Off and the warning messages you are seeing should go away.
 [2003-01-13 03:28 UTC] peton at cavalex dot com
Hello,

  after reading with more attention the 'bugs database', 
this bug is the same than http://bugs.php.net/bug.php?id=21312 (31/Dec/2002).

Best regards,

Nicolas
 [2003-01-14 19:14 UTC] mmm at plesk dot com
The same problem with that warning. I've added comments to
http://bugs.php.net/bug.php?id=21312
 [2003-01-17 12:44 UTC] angelo at ispl dot ca
I have to side with Nicolas -- I have the same problem and do not think this is a "bogus" report.

I am using Horde 2.2, PHP 4.3.0, Apache 2.0.43, kernel 2.4.20 -- all the latest stuff and most current relevant libraries I could find.  I have played with the php.ini file changing settings of register_global as well as the two session.bug_compat settings.  I have tried using ones and zeros, as well as "Off" as suggested by iliaa@php.net below.  Nothing works.

I restart Apache each time, and I close the browser and re-open to be sure nothing is cached.  I have scanned by hard disk to be sure there are not two "php.ini" files, even though I have seen clear evidence that other changes to the php.ini file DO take effect.

Sure looks like a bug to me, if not in php then in the docs.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Fri May 03 21:01:32 2024 UTC