|  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #80113 .user.ini may not be applied in subdirectories if CONTEXT_DOCUMENT_ROOT is set
Submitted: 2020-09-16 21:09 UTC Modified: 2020-10-19 09:25 UTC
Avg. Score:4.0 ± 0.0
Reproduced:1 of 1 (100.0%)
Same Version:1 (100.0%)
Same OS:1 (100.0%)
From: mattr at wordfence dot com Assigned: nikic (profile)
Status: Closed Package: CGI/CLI related
PHP Version: 8.0.0beta3 OS: Linux
Private report: No CVE-ID: None
View Add Comment Developer Edit
Anyone can comment on a bug. Have a simpler test case? Does it work for you on a different platform? Let us know!
Just going to say 'Me too!'? Don't clutter the database with that please !
Your email address:
Solve the problem:
28 - 14 = ?
Subscribe to this entry?

 [2020-09-16 21:09 UTC] mattr at wordfence dot com
The .user.ini file is no longer applied in subdirectories, when Apache is configured to serve PHP via CGI with configuration like this:
  ScriptAlias /local-bin /usr/local/bin
  AddHandler application/x-httpd-php-8-0 .php
  Action application/x-httpd-php-8-0 /local-bin/php-cgi

As far as I can tell, this is caused by the new handling of CONTEXT_DOCUMENT_ROOT in sapi_cgi_activate() in sapi/cgi/cgi_main.c.

Using phpinfo, I see that CONTEXT_DOCUMENT_ROOT is not where the php files are located:
  CONTEXT_DOCUMENT_ROOT: /usr/local/bin 
  DOCUMENT_ROOT: /home/user/public_html

When php_cgi_ini_activate_user_config() checks if the script is inside the document root, it is using the value from CONTEXT_DOCUMENT_ROOT, which doesn't match -- so it is no longer looking in parent directories for .user.ini files.


Add a Patch

Pull Requests

Add a Pull Request


AllCommentsChangesGit/SVN commitsRelated reports
 [2020-09-22 14:49 UTC] willypbender83 at gmail dot com
This was introduced as a fix for

What are you using CONTEXT_DOCUMENT_ROOT for? Not for UserDir module?
 [2020-09-22 14:57 UTC] mattr at wordfence dot com
I'm actually not trying to use CONTEXT_DOCUMENT_ROOT for anything. Apache sets it when using this kind of CGI configuration, and after the change in 64865, PHP tries to use that to find .user.ini instead of the DOCUMENT_ROOT, which would be the correct path in this case.
 [2020-10-19 09:25 UTC]
-Status: Open +Status: Closed -Assigned To: +Assigned To: nikic
 [2020-10-19 09:25 UTC]
I've reverted the CONTEXT_DOCUMENT_ROOT change for now, so this should be fixed.
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Fri Mar 01 12:01:29 2024 UTC