php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #27530 safe_mode breaks authorization via header() in 4.3.5RC2, too
Submitted: 2004-03-08 17:49 UTC Modified: 2004-03-08 21:16 UTC
Votes:1
Avg. Score:5.0 ± 0.0
Reproduced:1 of 1 (100.0%)
Same Version:1 (100.0%)
Same OS:1 (100.0%)
From: arekm at pld-linux dot org Assigned:
Status: Closed Package: Output Control
PHP Version: 4.3.4 OS: Linux 2.4/2.6 + glibc 2.3.2
Private report: No CVE-ID:
 [2004-03-08 17:49 UTC] arekm at pld-linux dot org
Description:
------------
The problem is that when safe_mode = On and we have simple script:
<?php
  header('WWW-Authenticate: Basic realm=\"log in\"');
  header('HTTP/1.0 401 Unauthorized');
  exit;
?>
and I get
 3 Server: Apache/2.0.48 (Unix) mod_fastcgi/2.4.2 mod_ssl/2.0.48 OpenSSL/0.9.7c DAV/2
 4 X-Powered-By: PHP/4.3.5RC2
 5 WWW-Authenticate: 1000
which is unknown authentication method for any browser.

According to documentation (http://pl2.php.net/manual/en/features.safe-mode.functions.php) UID should be appended to user specified string.

Tested in on different setups like apache 1.3.29+php 4.3.3, php 4.3.4, apache 2.0.48+php 4.3.5RC2 in fastcgi mode, without fastcgi mode. Always reproducible.

Turning safe_mode = Off fixes problem of course.

Reproduce code:
---------------
See description.

Expected result:
----------------
 3 Server: Apache/2.0.48 (Unix) mod_fastcgi/2.4.2 mod_ssl/2.0.48 OpenSSL/0.9.7c DAV/2
 4 X-Powered-By: PHP/4.3.5RC2
 5 WWW-Authenticate: Basic realm=\"log in\"

+ somehwere UID since that's safe mode.

Actual result:
--------------
 3 Server: Apache/2.0.48 (Unix) mod_fastcgi/2.4.2 mod_ssl/2.0.48 OpenSSL/0.9.7c DAV/2
 4 X-Powered-By: PHP/4.3.5RC2
 5 WWW-Authenticate: 1000


Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2004-03-08 21:16 UTC] iliaa@php.net
This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.


 
PHP Copyright © 2001-2014 The PHP Group
All rights reserved.
Last updated: Wed Apr 23 09:02:23 2014 UTC