#20891 [Opn->Csd]: Misuse PATH_INFO, PATH_TRANSLATED environment variables in CGI, Fastcgi SAPI

ID: 20891 Updated by: sniper@php.net Reported By: gangwang@optonline.net -Status: Open +Status: Closed Bug Type: Feature/Change Request Operating System: Linux PHP Version: 4.2.3 New Comment: This is actually fixed in CVS by Shane last week, iirc. Previous Comments: ------------------------------------------------------------------------ [2002-12-08 20:14:59] gangwang@optonline.net I am writting a web server which can support PHP. I found the CGI and fastcgi SAPI modules misuse the PATH_INFO, PATH_TRANSLATED environment variables, at least I think they are. I did the following test with apache-1.3.24: I had phpinfo.php and php executable in cgi-bin directory: $ more phpinfo.php #!./php <HTML> <BODY> <?php phpinfo() ?> </BODY> </HTML> The request: http://localhost/cgi-bin/phpinfo.php has no problem The request: http://localhost/cgi-bin/phpinfo.php/path/info will return 500 Internal server error same thing will happen with fastcgi SAPI. the second request will succeed with mod_php. I read the code of CGI and fastcgi modules and found PATH_TRANSLATED is used as the path of php scirpt file when it exists, otherwise SCRIPT_FILENAME will be used. Then for the second request, the script file refered as PATH_TRANSLATED will not be found. The PATH_INFO is not used in the right way too. PATH_INFO is used as the request URI, if it exists, otherwise SCRIPT_NAME is used. They are is not compliant with CGI 1.1 or 1.2 specification. The right way to use those environment variables are: reuqest URI = <REQUEST_URI> or <SCRIPT_NAME>+<PATH_INFO> script_file_path = <SCRIPT_FILENAME>. <PATH_TRANSLATED> should NOT be touched. If <SCRIPT_FILENAME> does not exist, you can try to build the script_file_path from <DOCUMENT_ROOT>+<SCRIPT_NAME>, but that is not guaranteed to be correct. Best regards, Gang Wang ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=20891&edit=1