Bug #16155 Updated: track_vars doesn't work unless register_globals is also set

From:	rasmus@php.net	Date:	Tue, 19 Mar 2002 04:03:06 +0000
Subject:	Bug #16155 Updated: track_vars doesn't work unless register_globals is also set
References:	1	Groups:	php.bugs
Request:	Send a blank email to php-bugs+get-2821@lists.php.net to get a copy of this message

 ID:               16155
 Updated by:       rasmus@php.net
 Reported By:      rlm@pricegrabber.com
-Status:           Open
+Status:           Feedback
 Bug Type:         PHP options/info functions
 Operating System: RH 7.2
 PHP Version:      4.1.2
 New Comment:

Uh, can anybody reproduce this?  I certainly can't.  HTTP_*_VARS are
definitely on for me regardless of the register_globals setting.  I
suspect user error here.


Previous Comments:
------------------------------------------------------------------------

[2002-03-18 18:18:54] rlm@pricegrabber.com

The entire point of "register_globals Off" is to provide a mechanism to
disable automatic registration of EGPCS (Environment, Get, Post,
Cookie, System) variables.  However, for this to be an effective
strategy, scripts need access to these variables by other means.  This
SHOULD be the HTTP_*_VARS and _GET[], _POST[], etc. variables.  But as
of 4.1.2, track_vars (which is set on by default) doesn't work unless

(1) register_globals is set On, AND
(2) variables_order contains the particular type of variable you want. 
That is, unless you set variables_order to contain "G", neither _GET[]
nor HTTP_GET_VARS[] will be contain the results from the GET request,
but if variables_order does contain "G", they *will*.

Considering the number of exploits caused by namespace pollution that
register_globals has been accused (and convicted) of, this is about as
serious a security bug as I can think of.  I will be digging through
the source tree to come up with a patch.

------------------------------------------------------------------------


-- 
Edit this bug report at http://bugs.php.net/?id=16155&edit=1



   

Thread (21 messages)

• rlm at pricegrabber dot comMon, 18 Mar 2002 23:18:55 +0000
  • rasmus@php.netTue, 19 Mar 2002 04:03:06 +0000Bug #16155 Updated: track_vars doesn't work unless register_globals is also set
  • rlm at pricegrabber dot comTue, 19 Mar 2002 04:14:35 +0000Bug #16155 Updated: track_vars doesn't work unless register_globals is also set
  • rlm at pricegrabber dot comTue, 19 Mar 2002 04:27:16 +0000Bug #16155 Updated: track_vars doesn't work unless register_globals is also set
  • sander@php.netTue, 19 Mar 2002 09:19:24 +0000Bug #16155 Updated: track_vars doesn't work unless register_globals is also set
  • rlm at pricegrabber dot comTue, 19 Mar 2002 15:19:41 +0000Bug #16155 Updated: Some predefined variables allow GET overwrite
  • rlm at pricegrabber dot comTue, 19 Mar 2002 16:42:25 +0000Bug #16155 Updated: Some predefined variables allow GET overwrite
  • rlm at pricegrabber dot comTue, 19 Mar 2002 23:56:11 +0000Bug #16155 Updated: _GET[] &c. not set unless variables_order position set
  • ftm at gtd dot esWed, 10 Jul 2002 14:00:06 +0000Bug #16155 Updated: track_vars doesn't work unless register_globals is also set
  • philip@php.netWed, 10 Jul 2002 17:13:11 +0000Bug #16155 Updated: track_vars doesn't work unless register_globals is also set
  • rlm at pricegrabber dot comWed, 10 Jul 2002 17:46:01 +0000Bug #16155 Updated: track_vars doesn't work unless register_globals is also set
  • philip@php.netWed, 10 Jul 2002 18:09:36 +0000Bug #16155 Updated: track_vars doesn't work unless register_globals is also set
  • rlm at pricegrabber dot comWed, 10 Jul 2002 20:37:45 +0000Bug #16155 Updated: track_vars doesn't work unless register_globals is also set
  • philip@php.netWed, 10 Jul 2002 22:21:54 +0000Bug #16155 Updated: variables_order affects existence of php predefined variables
  • rlm at pricegrabber dot comWed, 10 Jul 2002 22:57:34 +0000Bug #16155 Updated: variables_order affects existence of php predefined variables
  • rlm at pricegrabber dot comWed, 10 Jul 2002 23:02:52 +0000Bug #16155 Updated: variables_order affects existence of php predefined variables
  • philip@php.netThu, 11 Jul 2002 00:08:47 +0000Bug #16155 Updated: variables_order affects existence of php predefined variables
  • rlm at pricegrabber dot comThu, 11 Jul 2002 00:13:50 +0000Bug #16155 Updated: variables_order affects existence of php predefined variables
  • philip@php.netMon, 07 Oct 2002 17:38:21 +0000#16155 [Opn]: variables_order affects existence of php predefined variables
  • cly109 at 126 dot comWed, 29 Jul 2009 01:42:02 +0000#16155 [Com]: variables_order affects existence of php predefined variables
  • jani@php.netFri, 31 Dec 2010 23:29:34 +0000Req #16155 [Opn->Bgs]: variables_order affects existence of php predefined variables