Edit report at https://bugs.php.net/bug.php?id=80385&edit=1
ID: 80385
Updated by: requinix@php.net
Reported by: 306503207 at qq dot com
Summary: Response data preceded by post data
Status: Open
Type: Bug
Package: FPM related
Operating System: CentOS 7.4
PHP Version: 7.2.34
Block user comment: N
Private report: N
New Comment:
This may very well be my imagination getting the best of me, but seeing a configuration with
allow_url_include=on and auto_prepend_file=input, that's the sort of thing I would attribute to
a hack. Because with those enabled, someone can run PHP code on your server without having to
compromise any application files. Though there is normally some sort of trigger to get that behavior
- it randomly happening would break stuff and draw attention to the problem.
Have you looked into that sort of possibility? Do you have access logs you can check to see if
there's anything suspicious? Are your php-fpm pools configured securely? Any unauthorized file
changes?
And when you compared phpinfo outputs, did you compare the *entire* output? Everything from the
configure command to the extension settings?
Previous Comments:
------------------------------------------------------------------------
[2020-11-23 18:39:21] shoebox at dnbradio dot com
I'm now wondering if this could be caused by a bug in one of the php modules so I am disabling
them for now. I suspect this could be caused by the mongo module since the OP mentioned something
mongo-related in their original report. Here is my Docker file showing all modules I have currently
enabled. I will disable all of these to see if the problem persists.
FROM php:7.4-fpm
RUN apt-get update && apt-get install -y \
libfreetype6-dev \
libssl-dev \
libpng-dev \
libjpeg62-turbo-dev \
libmcrypt-dev \
libmagickwand-dev --no-install-recommends \
zip \
unzip \
git-all \
libaspell-dev \
mariadb-client --no-install-recommends \
&& docker-php-ext-install pdo_mysql \
&& pecl install imagick \
&& docker-php-ext-enable imagick \
&& docker-php-ext-configure gd \
--with-freetype \
--with-jpeg \
&& docker-php-ext-install -j$(nproc) gd \
&& pecl install mongodb \
&& docker-php-ext-enable mongodb \
&& pecl install mailparse \
&& docker-php-ext-enable mailparse
------------------------------------------------------------------------
[2020-11-23 18:24:43] shoebox at dnbradio dot com
Here is side-by-side comparison of phpinfo() where 2 impacting config settings are being toggled on
and off between page refreshes.
https://www.dropbox.com/s/9ae2pqi2nffchog/screen%20shot%202020-11-23%20at%2011.18.40%20am.png?dl=0
Settings being toggled are:
auto_prepend_file
allow_url_include
These settings are explicitly set to "none" in /usr/local/etc/php/php.ini however php
seemingly is toggling these settings to On or php://input by itself.
Restarting the server fixes the issue for some time.
I tried various php-fpm versions. This is happening in 7.2, 7.3, 7.4
------------------------------------------------------------------------
[2020-11-23 08:32:33] 306503207 at qq dot com
I update to PHP-7.3.23, but problems still arise.
------------------------------------------------------------------------
[2020-11-23 04:11:54] 306503207 at qq dot com
https://bugs.php.net/bug.php?id=80378
content-type: application/octet-stream
Maybe this bug is also caused by this situation.
------------------------------------------------------------------------
[2020-11-23 03:56:24] 306503207 at qq dot com
After restarting PHP-fpm, the response is correct. After a period of time, this problem occurs
again.In your issue, does it work to restart php-fpmï¼
------------------------------------------------------------------------
The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
https://bugs.php.net/bug.php?id=80385
--
Edit this bug report at https://bugs.php.net/bug.php?id=80385&edit=1