#39927 [Opn->Bgs]: server variable names are silently changed

ID: 39927 Updated by: iliaa@php.net Reported By: to_devnull at yahoo dot com -Status: Open +Status: Bogus Bug Type: Apache related Operating System: all PHP Version: 5.2.0 New Comment: Thank you for taking the time to write to us, but this is not a bug. Please double-check the documentation available at http://www.php.net/manual/ and the instructions on how to report a bug at http://bugs.php.net/how-to-report.php This is legacy of register_globals, as long as it exists . and spaces in input var names will be converted to underscores. Previous Comments: ------------------------------------------------------------------------ [2006-12-22 00:28:27] to_devnull at yahoo dot com Description: ------------ I'm "reopening" Bug #13961 since some moron marked it as "bogus" and I can't comment on it: http://bugs.php.net/bug.php?id=13961 Apache module mod_setenvif sets variables in r->subprocess_env. If variable name contains character ".", then sapi_apache_register_server_variables() will replace it with "_". This breaks internal variables like force-response-1.0 (php changes it to force-response-1_0). I hit this bug with PHP4.4.3/PHP5 and latest Apache 1.3.37. Spent several hours tracing in debugger why "downgrade-1.0" becomes "downgrade-1_0". This is a serious bug -- basically it's impossible to downgrade client request/server response to HTTP 1.0 (or disable chunking) if php is involved. What a shame! Reproduce code: --------------- I actually traced it by shoving a static string containing '.' in r->subprocess_env and thus getting Apache to core dump when php tries to write to read-only memory in php_register_variable_ex(). ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=39927&edit=1