Req #66851 [NEW]: $_SERVER holds unrelated client stuff
From: eldmannen+php at gmail dot com Date: Fri, 07 Mar 2014 23:25:10 +0000 Subject: Req #66851 [NEW]: $_SERVER holds unrelated client stuff Groups: php.bugs Request: Send a blank email to php-bugs+get-184613@lists.php.net to get a copy of this message
From: eldmannen+php at gmail dot com Operating system: PHP version: Irrelevant Package: Variables related Bug Type: Feature/Change Request Bug description:$_SERVER holds unrelated client stuff Description: ------------ http://websec.io/2012/08/11/Can%27t-Trust-the-$_SERVER.html The superglobal $_SERVER contains unrelated stuff such as HTTP_USER_AGENT and HTTP_REFERER which are from the client and set by the client, not the server. These ought to be stripped out and moved into a new superglobal called $_CLIENT. -- Edit bug report at https://bugs.php.net/bug.php?id=66851&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=66851&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=66851&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=66851&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=66851&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=66851&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=66851&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=66851&r=needscript Try newer version: https://bugs.php.net/fix.php?id=66851&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=66851&r=support Expected behavior: https://bugs.php.net/fix.php?id=66851&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=66851&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=66851&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=66851&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=66851&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=66851&r=dst IIS Stability: https://bugs.php.net/fix.php?id=66851&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=66851&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=66851&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=66851&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=66851&r=mysqlcfg
Thread (5 messages)
| « previous | php.bugs (#184613) | next » |
|---|