php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #64138 Setting error_log from .htaccess can leak between sites
Submitted: 2013-02-03 21:05 UTC Modified: -
From: php at nearlyfreespeech dot net Assigned:
Status: Open Package: Apache2 related
PHP Version: 5.3.21 OS: Any
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If this is not your bug, you can add a comment by following this link.
If this is your bug, but you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: php at nearlyfreespeech dot net
New email:
PHP Version: OS:

 

 [2013-02-03 21:05 UTC] php at nearlyfreespeech dot net
Description:
------------
Using mod_php5 under Apache 2.2.x, if the PHP error_log value is set from 
.htaccess in two separate virtual hosts then under at least some 
conditions, the setting leaks between the virtual hosts.

For example, if an Apache server is configured with two virtual hosts, site1 and 
site2, and site1 has an .htaccess file in its document root containing:

php_value error_log /sites/site1/logs/php_errors.log

And site2 has an .htaccess file in its document root containing:

php_value error_log /sites/site2/logs/php_errors.log

Then under at least some conditions, site2 (uid 10002) will attempt to log 
errors to site1's (uid 10001) specified file.  If safe_mode is enabled, this 
will fail, causing the following to be written to site1's file:

[Sun Feb 03 12:00:00 2013] [error] [client 10.20.40.80] PHP Warning:  Unknown: 
SAFE MODE Restriction in effect.  The script whose uid/gid is 10002/10002 is not 
allowed to access /sites/site1/logs/php_errors.log owned by uid/gid 10001/10001 
in Unknown on line 0

Note this error is formatted by *Apache* appearing in the *PHP* error log.  If 
it were coming straight from PHP, it would be in the format:

[03-Feb-2013 12:00:00 UTC] PHP Warning:  Unknown: 
SAFE MODE Restriction in effect.  The script whose uid/gid is 10002/10002 is not 
allowed to access /sites/site1/logs/php_errors.log owned by uid/gid 10001/10001 
in Unknown on line 0

That may help narrow down where the problem is, since it is infuriatingly 
intermittent.



Expected result:
----------------
Errors from each site should only appear in that site's specified error_log file.



Actual result:
--------------
Errors are occasionally written to the wrong site's log file.


Patches

Add a Patch

Pull Requests

Add a Pull Request

 
PHP Copyright © 2001-2019 The PHP Group
All rights reserved.
Last updated: Tue Sep 17 17:01:28 2019 UTC