#18675 [NEW]: aborting scripts when user hits "stop" in browser

From: radu.rendec@ines.ro Operating system: any PHP version: 4.2.2 PHP Bug Type: Feature/Change Request Bug description: aborting scripts when user hits "stop" in browser The default behavior, as reported in the documentation, is to abort scripts with the ABORTED flag on _when the script tries to output something_. This may lead to a security issue. Suppose that a malicious (or dummy) user of a shared web hosting system makes a dead loop in a script and no output is produced inside that loop. Moreover, the script makes some system calls inside that loop so the time limit counter is slowly incremented (or even not incremented at all). So the time limit protection won't work, and neither the ABORTED flag protection (because no output is made inside the loop). If a remote user tries to access the broken script via the browser and hits the stop button, the script will run on the server for ever, causing serious load. If more users try to access the broken script (or the same user tries to access it more times), the server will have a huge load and will soon be unusable. I suggest the default behavior be to abort the execution of the script as soon as the connection is aborted. -- Edit bug report at http://bugs.php.net/?id=18675&edit=1 -- Fixed in CVS: http://bugs.php.net/fix.php?id=18675&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=18675&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=18675&r=needtrace Try newer version: http://bugs.php.net/fix.php?id=18675&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=18675&r=support Expected behavior: http://bugs.php.net/fix.php?id=18675&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=18675&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=18675&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=18675&r=globals