Bug #80385 [Opn]: Response data preceded by post data

From: Date: Wed, 02 Dec 2020 00:44:47 +0000
Subject: Bug #80385 [Opn]: Response data preceded by post data
References: 1  Groups: php.bugs 
Request: Send a blank email to php-bugs+get-230779@lists.php.net to get a copy of this message 
Edit report at https://bugs.php.net/bug.php?id=80385&edit=1

 ID:                 80385
 Updated by:         requinix@php.net
 Reported by:        306503207 at qq dot com
 Summary:            Response data preceded by post data
 Status:             Open
 Type:               Bug
 Package:            FPM related
 Operating System:   CentOS 7.4
 PHP Version:        7.2.34
 Block user comment: N
 Private report:     N

 New Comment:

There are quite a few variables and moving parts here. Can someone upload/link to a small but
complete repro somewhere? Like with a Dockerfile or two, maybe docker-compose file, and test script?


Previous Comments:
------------------------------------------------------------------------
[2020-12-01 22:21:42] maxime dot mazouth-laurol at hotmail dot fr

Did someone find a solution for this issue ? 
I have the same with php:7.2-fpm docker container named "engine" from now on.

Even if the POST data prepends the response, I keep getting none values from php.ini :
* linux command : docker-compose exec engine php -i | grep prepend
* output        : auto_prepend_file => no value => no value

* linux command : docker-compose exec engine php -i | grep url_include
* output        : allow_url_include => Off => Off

------------------------------------------------------------------------
[2020-11-24 04:25:23] 306503207 at qq dot com

How to configure PHP FPM pool security

------------------------------------------------------------------------
[2020-11-24 04:20:21] 306503207 at qq dot com

检测到中文(简体)
英语
通用领域
生物医药

I think PHP was attacked. I can reproduce this situation. For example, by using nginx, the
configuration parameters can modify the PHP configuration. The configuration is as follows:

#fastcgi_param PHP_VALUE "auto_prepend_file= php://input \n auto_append_file= php://input
";

#fastcgi_param PHP_ADMIN_VALUE "allow_url_include=On";

How can I close PHP_ADMIN_VALUE of parameter?

------------------------------------------------------------------------
[2020-11-23 23:51:35] dano at fashionphile dot com

We are getting the exact same problem since 11/13/2020 we have started getting the exact same issue.
We are on php 7.3.24 currently. We have narrowed this issue down to only post requests and whenever
we restart PHP-fpm it solves the issue for about an hour of time, then continues again.

------------------------------------------------------------------------
[2020-11-23 19:43:02] shoebox at dnbradio dot com

re: phpinfo() -- yes I did a diff on the full phpinfo() output. I trimmed it down in my previous
post so that it would fit within a single screenshot.

re: hack, I thought the same thing; but given that this is an isolated freshly built container I am
thinking that's not the case. I've setup firewall so that no outside traffic besides my
own IP can hit the server but the issue still reoccurred. I will try testing on a local machine
deployment as well from a freshly built container. 

re:pools -- no additional pool configuration is added. There is only a single app running on this
container and running on this host. I'll look further into this.

------------------------------------------------------------------------


The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at

    https://bugs.php.net/bug.php?id=80385


--
Edit this bug report at https://bugs.php.net/bug.php?id=80385&edit=1

Thread (53 messages)

« previous php.bugs (#230779) next »