Bug #80385 [Opn]: Response data preceded by post data

From: Date: Thu, 03 Dec 2020 23:42:02 +0000
Subject: Bug #80385 [Opn]: Response data preceded by post data
References: 1  Groups: php.bugs 
Request: Send a blank email to php-bugs+get-230830@lists.php.net to get a copy of this message 
Edit report at https://bugs.php.net/bug.php?id=80385&edit=1

 ID:                 80385
 Updated by:         requinix@php.net
 Reported by:        306503207 at qq dot com
 Summary:            Response data preceded by post data
 Status:             Open
 Type:               Bug
 Package:            FPM related
 Operating System:   CentOS 7.4
 PHP Version:        7.2.34
 Block user comment: N
 Private report:     N

 New Comment:

Even if it isn't strictly the container at fault, even if it ends up being an issue with Docker
or Debian or something else, if the container on Debian reproduces then that's at least a
starting point to look into it further.


Previous Comments:
------------------------------------------------------------------------
[2020-12-03 20:25:46] maxime dot mazouth-laurol at hotmail dot fr

I would be glad to do so, but I can't...

The reason ? I have the exact same docker container (php7.2-fpm) on a remote debian server and
locally under ubuntu but : 
* the problem appears on the debian server  (Debian GNU/Linux 9.8 stretch)
* the problem does not appear on my ubuntu 18.04 local machine, so I cannot reproduce it..

Then, one could logically think that the root cause is not in the docker container itself.
But if I restart the docker container, the issue disappears for some time, so it is container
related.

------------------------------------------------------------------------
[2020-12-02 00:44:47] requinix@php.net

There are quite a few variables and moving parts here. Can someone upload/link to a small but
complete repro somewhere? Like with a Dockerfile or two, maybe docker-compose file, and test script?

------------------------------------------------------------------------
[2020-12-01 22:21:42] maxime dot mazouth-laurol at hotmail dot fr

Did someone find a solution for this issue ? 
I have the same with php:7.2-fpm docker container named "engine" from now on.

Even if the POST data prepends the response, I keep getting none values from php.ini :
* linux command : docker-compose exec engine php -i | grep prepend
* output        : auto_prepend_file => no value => no value

* linux command : docker-compose exec engine php -i | grep url_include
* output        : allow_url_include => Off => Off

------------------------------------------------------------------------
[2020-11-24 04:25:23] 306503207 at qq dot com

How to configure PHP FPM pool security

------------------------------------------------------------------------
[2020-11-24 04:20:21] 306503207 at qq dot com

检测到中文(简体)
英语
通用领域
生物医药

I think PHP was attacked. I can reproduce this situation. For example, by using nginx, the
configuration parameters can modify the PHP configuration. The configuration is as follows:

#fastcgi_param PHP_VALUE "auto_prepend_file= php://input \n auto_append_file= php://input
";

#fastcgi_param PHP_ADMIN_VALUE "allow_url_include=On";

How can I close PHP_ADMIN_VALUE of parameter?

------------------------------------------------------------------------


The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at

    https://bugs.php.net/bug.php?id=80385


--
Edit this bug report at https://bugs.php.net/bug.php?id=80385&edit=1

Thread (53 messages)

« previous php.bugs (#230830) next »