Bug #16155 Updated: track_vars doesn't work unless register_globals is also set

From:	rlm at pricegrabber dot com	Date:	Tue, 19 Mar 2002 04:27:16 +0000
Subject:	Bug #16155 Updated: track_vars doesn't work unless register_globals is also set
References:	1	Groups:	php.bugs
Request:	Send a blank email to php-bugs+get-2823@lists.php.net to get a copy of this message

 ID:               16155
 Updated by:       rlm@pricegrabber.com
 Reported By:      rlm@pricegrabber.com
 Status:           Open
 Bug Type:         PHP options/info functions
 Operating System: RH 7.2
 PHP Version:      4.1.2
 New Comment:

Ah, I think I understand maybe why you can't replicate this.  In my
/etc/httpd/conf/include.d directory (the entire dir is parsed by Apache
on startup), I have a file that has the following lines in it, in the
order following:

    php_value variables_order "es"
    php_flag register_globals Off

Remove the file containing these lines, and it works.  Install the file
containing these lines, and it fails.


Previous Comments:
------------------------------------------------------------------------

[2002-03-18 23:14:35] rlm@pricegrabber.com

Maybe this should be registered against the RedHat distribution?  It's
100% consistent for me.

------------------------------------------------------------------------

[2002-03-18 23:03:06] rasmus@php.net

Uh, can anybody reproduce this?  I certainly can't.  HTTP_*_VARS are
definitely on for me regardless of the register_globals setting.  I
suspect user error here.

------------------------------------------------------------------------

[2002-03-18 18:18:54] rlm@pricegrabber.com

The entire point of "register_globals Off" is to provide a mechanism to
disable automatic registration of EGPCS (Environment, Get, Post,
Cookie, System) variables.  However, for this to be an effective
strategy, scripts need access to these variables by other means.  This
SHOULD be the HTTP_*_VARS and _GET[], _POST[], etc. variables.  But as
of 4.1.2, track_vars (which is set on by default) doesn't work unless

(1) register_globals is set On, AND
(2) variables_order contains the particular type of variable you want. 
That is, unless you set variables_order to contain "G", neither _GET[]
nor HTTP_GET_VARS[] will be contain the results from the GET request,
but if variables_order does contain "G", they *will*.

Considering the number of exploits caused by namespace pollution that
register_globals has been accused (and convicted) of, this is about as
serious a security bug as I can think of.  I will be digging through
the source tree to come up with a patch.

------------------------------------------------------------------------


-- 
Edit this bug report at http://bugs.php.net/?id=16155&edit=1



   

Thread (21 messages)

• rlm at pricegrabber dot comMon, 18 Mar 2002 23:18:55 +0000
  • rasmus@php.netTue, 19 Mar 2002 04:03:06 +0000Bug #16155 Updated: track_vars doesn't work unless register_globals is also set
  • rlm at pricegrabber dot comTue, 19 Mar 2002 04:14:35 +0000Bug #16155 Updated: track_vars doesn't work unless register_globals is also set
  • rlm at pricegrabber dot comTue, 19 Mar 2002 04:27:16 +0000Bug #16155 Updated: track_vars doesn't work unless register_globals is also set
  • sander@php.netTue, 19 Mar 2002 09:19:24 +0000Bug #16155 Updated: track_vars doesn't work unless register_globals is also set
  • rlm at pricegrabber dot comTue, 19 Mar 2002 15:19:41 +0000Bug #16155 Updated: Some predefined variables allow GET overwrite
  • rlm at pricegrabber dot comTue, 19 Mar 2002 16:42:25 +0000Bug #16155 Updated: Some predefined variables allow GET overwrite
  • rlm at pricegrabber dot comTue, 19 Mar 2002 23:56:11 +0000Bug #16155 Updated: _GET[] &c. not set unless variables_order position set
  • ftm at gtd dot esWed, 10 Jul 2002 14:00:06 +0000Bug #16155 Updated: track_vars doesn't work unless register_globals is also set
  • philip@php.netWed, 10 Jul 2002 17:13:11 +0000Bug #16155 Updated: track_vars doesn't work unless register_globals is also set
  • rlm at pricegrabber dot comWed, 10 Jul 2002 17:46:01 +0000Bug #16155 Updated: track_vars doesn't work unless register_globals is also set
  • philip@php.netWed, 10 Jul 2002 18:09:36 +0000Bug #16155 Updated: track_vars doesn't work unless register_globals is also set
  • rlm at pricegrabber dot comWed, 10 Jul 2002 20:37:45 +0000Bug #16155 Updated: track_vars doesn't work unless register_globals is also set
  • philip@php.netWed, 10 Jul 2002 22:21:54 +0000Bug #16155 Updated: variables_order affects existence of php predefined variables
  • rlm at pricegrabber dot comWed, 10 Jul 2002 22:57:34 +0000Bug #16155 Updated: variables_order affects existence of php predefined variables
  • rlm at pricegrabber dot comWed, 10 Jul 2002 23:02:52 +0000Bug #16155 Updated: variables_order affects existence of php predefined variables
  • philip@php.netThu, 11 Jul 2002 00:08:47 +0000Bug #16155 Updated: variables_order affects existence of php predefined variables
  • rlm at pricegrabber dot comThu, 11 Jul 2002 00:13:50 +0000Bug #16155 Updated: variables_order affects existence of php predefined variables
  • philip@php.netMon, 07 Oct 2002 17:38:21 +0000#16155 [Opn]: variables_order affects existence of php predefined variables
  • cly109 at 126 dot comWed, 29 Jul 2009 01:42:02 +0000#16155 [Com]: variables_order affects existence of php predefined variables
  • jani@php.netFri, 31 Dec 2010 23:29:34 +0000Req #16155 [Opn->Bgs]: variables_order affects existence of php predefined variables