php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #43247 PHP_SELF creates double path entry
Submitted: 2007-11-11 17:32 UTC Modified: 2007-11-20 14:35 UTC
From: yguardmail-php at yahoo dot co dot uk Assigned: dmitry (profile)
Status: Closed Package: CGI/CLI related
PHP Version: 5.2.5 OS: Windows XP
Private report: No CVE-ID: None
 [2007-11-11 17:32 UTC] yguardmail-php at yahoo dot co dot uk
Description:
------------
$_SESSION['PHP_SELF'] creates double path entry. This is the same problem as 42699 and 42523 which are supposed to be fixed.

I am using Abyss web server, version 2.5 with 'Interface' set to CGI/SAPI. This problem also occurs with Interface set to FASTCGI (Local-Pipes).

This problem did not occur on PHP builds up to, and including 5.2.3.

Reproduce code:
---------------
<?php 
session_start();   
echo $_SERVER['PHP_SELF'];
?>   

Expected result:
----------------
/testself/testself.php

Actual result:
--------------
/testself/testself.php/testself/testself.php

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2007-11-13 09:38 UTC] yguardmail-php at yahoo dot co dot uk
I have tried the latest build you suggested :

http://snaps.php.net/win32/php5.3-win32-latest.zip

but the problem still exists.
 [2007-11-13 11:06 UTC] jani@php.net
Dmitry, I thought you fixed this..? 
 [2007-11-13 13:33 UTC] dmitry@php.net
Sorry but Abyss version 2.5 is a comercial coftware and I am not able to downlaod and test it.

 [2007-11-13 13:47 UTC] yguardmail-php at yahoo dot co dot uk
I am using the FREE version of Abyss which is available for download from here :-

http://www.aprelium.com/abyssws/download.php
 [2007-11-14 01:23 UTC] jfrancis at connected dot net dot au
I am experiencing the exact same problem under IIS 5.1

Has there been any resolution to this problem?
 [2007-11-14 08:51 UTC] dmitry@php.net
The bug was fixed for IIS (not for Abysse) in 5.2.5.
Do you use older PHP version?
 [2007-11-14 10:41 UTC] dmitry@php.net
According to http://ru2.php.net/reserved.variables PHP_SELF is the filename of the currently executing script, relative to the document root. For instance, $_SERVER['PHP_SELF'] in a script at the address http://example.com/test.php/foo.bar would be /test.php/foo.bar.

According to http://hoohoo.ncsa.uiuc.edu/cgi/env.html PATH_INFO - is
the extra path information, as given by the client. In other words, scripts can be accessed by their virtual pathname, followed by extra information at the end of this path. The extra information is sent as PATH_INFO. This information should be decoded by the server if it comes from a URL before it is passed to the CGI script.

However IIS use its own standard. According to http://msdn2.microsoft.com/en-us/library/ms524602.aspx PATH_INFO - is a path information, as given by the client, for example, "/vdir/myisapi.dll/zip". If this information comes from a URL, it is decoded by the server before it is passed to the CGI script or ISAPI filter. 
If the AllowPathInfoForScriptMappings metabase property is set to true (to support exclusive CGI functionality), PATH_INFO will only contain "/zip" and ISAPI applications such as ASP will break.

However Abyss doesn't follow both standards. It sets PATH_INFO into the value of SCRIPT_NAME and loses extra path information.

I am not going to fix the bug, while I don't understand what standarad Abysse uses (It behave differently from Apache and IIS). This time I suppose it is an Abysse bug, but I am ready for discussion.
 [2007-11-20 14:35 UTC] yguardmail-php at yahoo dot co dot uk
Abyss claim to compy with CGI/1.1, as stated here :-

http://www.aprelium.com/data/doc/2/abyssws-win-doc-html/cgivars.html

'Before running a CGI application or interpreter, Abyss Web Server sets its environment variables in conformity with the CGI/1.1 specification (as described in http://hoohoo.ncsa.uiuc.edu/cgi) ....'.

PHP 5.2.3 works OK with the latest version of Abyss, so I can only assume that some change in PHP 5.2.4 introduced the problem.

Thanks to Dan Voisine who has Emailed me with a solution to this in Abyss :-

In Scripting Parameters, edit the Interpreter entry and change the Type field from 'PHP Style' to 'Standard'.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Thu Apr 18 01:01:28 2024 UTC