#14751 [Com]: [critical!] mozilla downloads source of .php files

ID: 14751 Comment by: janus@linux-de.org Reported By: info@mkmgmbh.com Status: Closed Bug Type: Apache related Operating System: redhat 7.1 glibc2.2.4 kernel2.4 PHP Version: 4.1.1 New Comment: How can that be? PHP is a preprocessor, so the files can't be delivered to the browser _before_ php processed them... but it seems that php refuses work... Another strange issue that teaches us not to use PHP :( Previous Comments: ------------------------------------------------------------------------ [2001-12-29 13:56:55] imajes@php.net Since this is not a php bug, (since the behaviour does not happen on IE), but does need investigation, I have opened a bug on the mozilla bug system: http://bugzilla.mozilla.org/show_bug.cgi?id=117354 They need a testcase, so if the reporter could recreate the problem, that would help. James Cox ------------------------------------------------------------------------ [2001-12-29 08:35:23] info@mkmgmbh.com seems resolved for us. This phenomenon occurs if the SSL-VirtualHost entry's ServerName differs from the main server's ServerName (in our case nexus.mkmgmbh.com and secure.mkmgmbh.com). Anyway, this is undocumented _and_ leads to strange behaviour (as posted before, IE seems to have no problems, while Mozilla is able to download PHP-Source-Code in this case, which makes this a definite security-risk for all not-thoroughly tested Internet sites!). Jonas Maurus MKM GmbH ------------------------------------------------------------------------ [2001-12-29 07:57:26] info@mkmgmbh.com I don't exactly understand how this happens, but with a Apache+mod_ssl server, Mozilla 0.9.7 is able to retrieve the source of a .php file, probably by sending non-standard headers. Software used: - Apache 1.3.22 - mod_ssl 2.8.5 - php 4.1.1 - VirtualHost on port 443 with SSLEngine On. - "AddHandler application/x-httpd-php .php" Test URL: https://secure.mkmgmbh.com/horde/test.php Using Internet Explorer 6, you get the compiled page, using Mozilla 0.9.7 it downloads the source, same url, different behaviour. Please note that the server uses a non-standard certificate (signed by our own CA). [Configure line: './configure' '--prefix=/httpd/php' '--with-apxs=/httpd/bin/apxs' '--with-config-file-path=/httpd/conf' '--with-gdbm=/usr' '--with-mysql=/usr' '--with-openssl=/usr' '--with-vpopmail=/home/vpopmail' '--with-gettext' '--with-xml' '--with-mcrypt=/usr' '--with-imap=/projects/serverupd/imap/imap-2001a' '--with-zlib=/usr'] ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=14751&edit=1