#46759 [Opn]: magic_quotes_gpc doesn't work
| From: | magicaltux@php.net | Date: | Sat, 06 Dec 2008 17:08:44 +0000 |
| Subject: | #46759 [Opn]: magic_quotes_gpc doesn't work | ||
| References: | 1 | Groups: | php.bugs |
| Request: | Send a blank email to php-bugs+get-131685@lists.php.net to get a copy of this message | ||
ID: 46759
Updated by: magicaltux@php.net
Reported By: vrana@php.net
Status: Open
Bug Type: Variables related
Operating System: Windows
PHP Version: 5.2.7
New Comment:
After checking bug #42718 and filter extension's documentation, I
believe enabling a filter *should not* disable magic_quotes_gpc (nothing
is written in the documentation about this).
This patch allows application of magic_quotes_gpc *after* filters
execution *if* enabled.
http://ookoo.org/svn/snip/php_5_2-broken_filter_and_magic_quotes.patch
Previous Comments:
------------------------------------------------------------------------
[2008-12-06 16:20:04] magicaltux@php.net
Fix for bug #42718 seems at the origin of this bug.
If the fix is reverted, magic_quotes_gpc works again as expected.
------------------------------------------------------------------------
[2008-12-06 10:03:18] cabel at panic dot com
We haven't yet had a chance to addslashes() our input in preparation
for
PHP 6.
So as it stands, this bug -- which we're also seeing with 5.2.7 --
currently means giant scary security holes in our scripts as we were
relying on magic_quotes_gpc to make things "safe".
Not great...
------------------------------------------------------------------------
[2008-12-06 01:28:00] brion at pobox dot com
This causes downstream MediaWiki bug:
https://bugzilla.wikimedia.org/show_bug.cgi?id=16570
Data corruption and failure to properly submit edits when
magic_quotes_gpc is enabled. (Workaround: disable magic_quotes_gpc so
input doesn't get munged by stripslashes().)
Presumably causes similar breakage in every other web app that attempts
to correct for magic_quotes_gpc.
------------------------------------------------------------------------
[2008-12-05 11:52:05] vrana@php.net
Description:
------------
magic_quotes_gpc doesn't escape $_GET, $_POST, $_COOKIE and $_REQUEST
variables. It worked with the same configuration under 5.2.6.
I have magic_quotes_gpc set in php.ini.
Reproduce code:
---------------
URL: ?q='
<?php
var_dump(PHP_VERSION);
var_dump(get_magic_quotes_gpc());
var_dump($_GET["q"]);
Expected result:
----------------
string(5) "5.2.7"
int(1)
string(2) "\'"
Actual result:
--------------
string(5) "5.2.7"
int(1)
string(2) "'"
------------------------------------------------------------------------
--
Edit this bug report at http://bugs.php.net/?id=46759&edit=1