#40761 [NEW]: header() is wrongly handled, thus causing problems for browsers

From: c dot kirschnick at gmx dot net Operating system: * PHP version: 4.4.5 PHP Bug Type: CGI related Bug description: header() is wrongly handled, thus causing problems for browsers Description: ------------ This bug was sent in before, but marked wrong "bogus"/"won't fix". (See Bug #38369). PHP does not correctly handle calls such as header("Status: ..."). In CGI mode it should process such a call as a changing the HTTP response code (consistent with its handling of, e.g., header("Location: ...")). However, at present there is no special handling of the Status: header. That's why sending Status: and then Location: causes a duplicate header: the Location: header is handled as a special case and causes sapi_update_response_code(302) to be called, whereas the Status: header is just added to the list of headers to be sent back to the web server (see bug #33225 incorrectly marked "bogus", I think because the reviewer doesn't understand CGI). Note that sending two different Status: headers explicitly with header("Status: ...") doesn't give this error, because the default operation is to *replace* the header, not add a new one. Since PHP should conform to the CGI-norm, this bug should be fixed. Although the IE does not fully stick to this norm, the FF does - which ignores duplicated headers, resulting in different behaviour of both. Reproduce code: --------------- <? header("HTTP/1.1 403 Forbidden"); ?> Expected result: ---------------- An error message created by the browser Actual result: -------------- IE: correct 403 FF: blank page (no output) The headers: HTTP/1.1 200 OK HTTP/1.1 403 Forbidden -- Edit bug report at http://bugs.php.net/?id=40761&edit=1 -- Try a CVS snapshot (PHP 4.4): http://bugs.php.net/fix.php?id=40761&r=trysnapshot44 Try a CVS snapshot (PHP 5.2): http://bugs.php.net/fix.php?id=40761&r=trysnapshot52 Try a CVS snapshot (PHP 6.0): http://bugs.php.net/fix.php?id=40761&r=trysnapshot60 Fixed in CVS: http://bugs.php.net/fix.php?id=40761&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=40761&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=40761&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=40761&r=needscript Try newer version: http://bugs.php.net/fix.php?id=40761&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=40761&r=support Expected behavior: http://bugs.php.net/fix.php?id=40761&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=40761&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=40761&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=40761&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=40761&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=40761&r=dst IIS Stability: http://bugs.php.net/fix.php?id=40761&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=40761&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=40761&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=40761&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=40761&r=mysqlcfg