Bug #79224 [NEW]: auto_prepend_file throught fcgi PHP_ADMIN_VALUE leacking
| From: | miksir at maker dot ru | Date: | Tue, 04 Feb 2020 13:46:55 +0000 |
| Subject: | Bug #79224 [NEW]: auto_prepend_file throught fcgi PHP_ADMIN_VALUE leacking | ||
| Groups: | php.bugs | ||
| Request: | Send a blank email to php-bugs+get-225354@lists.php.net to get a copy of this message | ||
From: miksir at maker dot ru
Operating system: Linux
PHP version: 7.4.2
Package: *Configuration Issues
Bug Type: Bug
Bug description:auto_prepend_file throught fcgi PHP_ADMIN_VALUE leacking
Description:
------------
When auto_prepend_file used as dynamic parameter throught fcgi
PHP_ADMIN_VALUE, PHP process remembered auto_prepend_file from first
request and used it for all next requests even if its empty
Test script:
---------------
Create 2 php scripts
index.php
```
<?php
Someclass::$var = 1;
```
init.php
```
<?php
class Someclass {
public static $var = 0;
}
```
Start docker
```
$ docker run --rm -p 9000:9000 -v $(pwd)/index.php:/opt/index.php -v
$(pwd)/init.php:/opt/init.php php:7.4-fpm
```
First request with PHP_ADMIN_VALUE="auto_prepend_file=/opt/init.php"
```
$ env -i REDIRECT_STATUS=200 SERVER_NAME=localhost SERVER_PORT=80
SERVER_ADDR=127.0.0.1 REMOTE_PORT=12345 REMOTE_ADDR=127.0.0.1
SERVER_SOFTWARE=test GATEWAY_INTERFACE=CGI/1.1 HTTPS=no
REQUEST_SCHEME=http SERVER_PROTOCOL=HTTP/1.0 DOCUMENT_ROOT=/opt
DOCUMENT_URI=/index.php REQUEST_URI=/index.php SCRIPT_NAME=/index.php
CONTENT_LENGTH="" CONTENT_TYPE="" REQUEST_METHOD=GET QUERY_STRING=""
SCRIPT_FILENAME=/opt/index.php
PHP_ADMIN_VALUE="auto_prepend_file=/opt/init.php"
/usr/local/bin/cgi-fcgi -bind -connect 127.0.0.1:9000
X-Powered-By: PHP/7.4.2
Content-type: text/html; charset=UTF-8
```
As expected.
Second request without PHP_ADMIN_VALUE
```
$ env -i REDIRECT_STATUS=200 SERVER_NAME=localhost SERVER_PORT=80
SERVER_ADDR=127.0.0.1 REMOTE_PORT=12345 REMOTE_ADDR=127.0.0.1
SERVER_SOFTWARE=test GATEWAY_INTERFACE=CGI/1.1 HTTPS=no
REQUEST_SCHEME=http SERVER_PROTOCOL=HTTP/1.0 DOCUMENT_ROOT=/opt
DOCUMENT_URI=/index.php REQUEST_URI=/index.php SCRIPT_NAME=/index.php
CONTENT_LENGTH="" CONTENT_TYPE="" REQUEST_METHOD=GET QUERY_STRING=""
SCRIPT_FILENAME=/opt/index.php /usr/local/bin/cgi-fcgi -bind -connect
127.0.0.1:9000
X-Powered-By: PHP/7.4.2
Content-type: text/html; charset=UTF-8
<br />
<b>Fatal error</b>: Uncaught Error: Class 'Someclass' not found in
/opt/index.php:3
Stack trace:
#0 {main}
thrown in <b>/opt/index.php</b> on line <b>3</b><br />
```
Error received as was expected
But now I'm repeating last fcgi call (without PHP_ADMIN_VALUE). When
fcgi request distributed to same process which received first request,
request processed without errors. So look like this process remembered
auto_prepend_file from first request.
```
$ env -i REDIRECT_STATUS=200 SERVER_NAME=localhost SERVER_PORT=80
SERVER_ADDR=127.0.0.1 REMOTE_PORT=12345 REMOTE_ADDR=127.0.0.1
SERVER_SOFTWARE=test GATEWAY_INTERFACE=CGI/1.1 HTTPS=no
REQUEST_SCHEME=http SERVER_PROTOCOL=HTTP/1.0 DOCUMENT_ROOT=/opt
DOCUMENT_URI=/index.php REQUEST_URI=/index.php SCRIPT_NAME=/index.php
CONTENT_LENGTH="" CONTENT_TYPE="" REQUEST_METHOD=GET QUERY_STRING=""
SCRIPT_FILENAME=/opt/index.php /usr/local/bin/cgi-fcgi -bind -connect
127.0.0.1:9000
X-Powered-By: PHP/7.4.2
Content-type: text/html; charset=UTF-8
```
--
Edit bug report at https://bugs.php.net/bug.php?id=79224&edit=1
--
Fix committed: https://bugs.php.net/fix.php?id=79224&r=fixed
Fixed in release: https://bugs.php.net/fix.php?id=79224&r=alreadyfixed
Need backtrace: https://bugs.php.net/fix.php?id=79224&r=needtrace
Need Reproduce Script: https://bugs.php.net/fix.php?id=79224&r=needscript
Try newer version: https://bugs.php.net/fix.php?id=79224&r=oldversion
Not developer issue: https://bugs.php.net/fix.php?id=79224&r=support
Expected behavior: https://bugs.php.net/fix.php?id=79224&r=notwrong
Not enough info: https://bugs.php.net/fix.php?id=79224&r=notenoughinfo
Submitted twice: https://bugs.php.net/fix.php?id=79224&r=submittedtwice
register_globals: https://bugs.php.net/fix.php?id=79224&r=globals
PHP version support discontinued: https://bugs.php.net/fix.php?id=79224&r=phptooold
Daylight Savings: https://bugs.php.net/fix.php?id=79224&r=dst
IIS Stability: https://bugs.php.net/fix.php?id=79224&r=isapi
Install GNU Sed: https://bugs.php.net/fix.php?id=79224&r=gnused
Floating point limitations: https://bugs.php.net/fix.php?id=79224&r=float
No Zend Extensions: https://bugs.php.net/fix.php?id=79224&r=nozend
MySQL Configuration Error: https://bugs.php.net/fix.php?id=79224&r=mysqlcfg