php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #64138 Setting error_log from .htaccess can leak between sites
Submitted: 2013-02-03 21:05 UTC Modified: 2021-08-22 04:22 UTC
From: php at nearlyfreespeech dot net Assigned: cmb (profile)
Status: No Feedback Package: Apache2 related
PHP Version: 5.3.21 OS: Any
Private report: No CVE-ID: None
View Add Comment Developer Edit
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If this is not your bug, you can add a comment by following this link.
If this is your bug, but you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: php at nearlyfreespeech dot net
New email:
PHP Version: OS:

 

 [2013-02-03 21:05 UTC] php at nearlyfreespeech dot net 
Description:
------------
Using mod_php5 under Apache 2.2.x, if the PHP error_log value is set from 
.htaccess in two separate virtual hosts then under at least some 
conditions, the setting leaks between the virtual hosts.

For example, if an Apache server is configured with two virtual hosts, site1 and 
site2, and site1 has an .htaccess file in its document root containing:

php_value error_log /sites/site1/logs/php_errors.log

And site2 has an .htaccess file in its document root containing:

php_value error_log /sites/site2/logs/php_errors.log

Then under at least some conditions, site2 (uid 10002) will attempt to log 
errors to site1's (uid 10001) specified file.  If safe_mode is enabled, this 
will fail, causing the following to be written to site1's file:

[Sun Feb 03 12:00:00 2013] [error] [client 10.20.40.80] PHP Warning:  Unknown: 
SAFE MODE Restriction in effect.  The script whose uid/gid is 10002/10002 is not 
allowed to access /sites/site1/logs/php_errors.log owned by uid/gid 10001/10001 
in Unknown on line 0

Note this error is formatted by *Apache* appearing in the *PHP* error log.  If 
it were coming straight from PHP, it would be in the format:

[03-Feb-2013 12:00:00 UTC] PHP Warning:  Unknown: 
SAFE MODE Restriction in effect.  The script whose uid/gid is 10002/10002 is not 
allowed to access /sites/site1/logs/php_errors.log owned by uid/gid 10001/10001 
in Unknown on line 0

That may help narrow down where the problem is, since it is infuriatingly 
intermittent.



Expected result:
----------------
Errors from each site should only appear in that site's specified error_log file.



Actual result:
--------------
Errors are occasionally written to the wrong site's log file.

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2021-08-11 11:50 UTC] cmb@php.net
-Status: Open +Status: Feedback -Assigned To: +Assigned To: cmb
 [2021-08-11 11:50 UTC] cmb@php.net 
Does this still happen to you with any of the actively supported
PHP versions[1]?

[1] <https://www.php.net/supported-versions.php>
 [2021-08-22 04:22 UTC] php-bugs at lists dot php dot net 
No feedback was provided. The bug is being suspended because
we assume that you are no longer experiencing the problem.
If this is not the case and you are able to provide the
information that was requested earlier, please do so and
change the status of the bug back to "Re-Opened". Thank you.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved. 		Last updated: Fri Apr 19 20:01:29 2024 UTC