Req #66851 [Com]: $_SERVER holds unrelated client stuff

From: Date: Sun, 09 Mar 2014 16:48:47 +0000
Subject: Req #66851 [Com]: $_SERVER holds unrelated client stuff
References: 1  Groups: php.bugs 
Request: Send a blank email to php-bugs+get-184641@lists.php.net to get a copy of this message 
Edit report at https://bugs.php.net/bug.php?id=66851&edit=1

 ID:                 66851
 Comment by:         phpmpan at mpan dot pl
 Reported by:        eldmannen+php at gmail dot com
 Summary:            $_SERVER holds unrelated client stuff
 Status:             Open
 Type:               Feature/Change Request
 Package:            Variables related
 PHP Version:        Irrelevant
 Block user comment: N
 Private report:     N

 New Comment:

$_SERVER doesn't hold server-originated data. It holds served-possesed data about
the execution environment. This is, among other things, information about the request currently
being processed.


Previous Comments:
------------------------------------------------------------------------
[2014-03-07 23:25:09] eldmannen+php at gmail dot com

Description:
------------
http://websec.io/2012/08/11/Can%27t-Trust-the-$_SERVER.html

The superglobal $_SERVER contains unrelated stuff such as HTTP_USER_AGENT and HTTP_REFERER which are
from the client and set by the client, not the server.

These ought to be stripped out and moved into a new superglobal called $_CLIENT.



------------------------------------------------------------------------



-- 
Edit this bug report at https://bugs.php.net/bug.php?id=66851&edit=1

Thread (5 messages)

« previous php.bugs (#184641) next »