php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #37157 force-cgi-redirect is not checked under FastCGI
Submitted: 2006-04-21 22:02 UTC Modified: 2006-07-19 15:06 UTC
Votes:3
Avg. Score:5.0 ± 0.0
Reproduced:3 of 3 (100.0%)
Same Version:1 (33.3%)
Same OS:1 (33.3%)
From: askalski at gmail dot com Assigned: dmitry (profile)
Status: Not a bug Package: CGI/CLI related
PHP Version: 5CVS-2006-04-21 (snap) OS: Linux
Private report: No CVE-ID: None
View Add Comment Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
You can add a comment by following this link or if you reported this bug, you can edit this bug over here.
(description)
Block user comment
Status: Assign to:
Package:
Bug Type:
Summary:
From: askalski at gmail dot com
New email:
PHP Version: OS:

 

 [2006-04-21 22:02 UTC] askalski at gmail dot com 
Description:
------------
The FastCGI version of PHP does not perform the force-cgi-redirect check for page requests.

If I request http://localhost/cgi-bin/php, PHP
tries to parse the PHP binary in /cgi-bin as
if it was a script.

If cgi.fix_pathinfo is turned off, users can
bypass .htaccess security.

See also bug #22846.


Reproduce code:
---------------
PHP was configured with:

./configure --enable-fastcgi --enable-force-cgi-redirect


My /cgi-bin/php is a wrapper script that sets up
FastCGI environment variables:

#! /bin/sh

export PHPRC=/etc/apache
export PHP_FCGI_CHILDREN=4
export PHP_FCGI_MAX_REQUESTS=512

exec /usr/local/bin/php


Expected result:
----------------
Security Alert! The PHP CGI cannot be accessed directly.

This PHP CGI binary was compiled with force-cgi-redirect enabled. This means that a page will only be served up if the REDIRECT_STATUS CGI variable is set, e.g. via an Apache Action directive.

For more information as to why this behaviour exists, see the manual page for CGI security.

For more information about changing this behaviour or re-enabling this webserver, consult the installation file that came with this distribution, or visit the manual page.


Actual result:
--------------
export PHPRC=/etc/apache
export PHP_FCGI_CHILDREN=4
export PHP_FCGI_MAX_REQUESTS=512

exec /usr/local/bin/php

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2006-04-29 12:45 UTC] dmitry@php.net 
Have you set "cgi.force_redirect=1" in your php.ini?
 [2006-04-29 17:20 UTC] askalski at gmail dot com 
Yes.  I've been through the cgi_main source code, which goes something like this:

main()
{
    ...
    /* this check here doesn't help in fastcgi mode */
    do_force_redirect_check();
    ...

    while (accept_fastcgi_connection())
    {
        import_cgi_environment();

        /* but here it would */
    }

    ...
}
 [2006-07-19 15:06 UTC] dmitry@php.net 
Then you access http://localhost/cgi-bin/php, "/cgi-bin/php" IS NOT RUN, but it is passed as a php script to FastCGI PHP process. PHP interpreter doesn't find any <?php tags and displays it as plain HTML.

This is mod_fastcgi or configuration problem. I don't understand why mod_fastcgi translate request to http://localhost/cgi-bin/php into FastCGI request.

This problem cannot be fixed on PHP level.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved. 		Last updated: Mon Apr 29 08:01:29 2024 UTC