Bug #16155 Updated: Some predefined variables allow GET overwrite

From: Date: Tue, 19 Mar 2002 16:42:25 +0000
Subject: Bug #16155 Updated: Some predefined variables allow GET overwrite
References: 1  Groups: php.bugs 
Request: Send a blank email to php-bugs+get-2890@lists.php.net to get a copy of this message
 ID:               16155
 Updated by:       rlm@pricegrabber.com
-Summary:          track_vars doesn't work unless register_globals is
                   also set
 Reported By:      rlm@pricegrabber.com
 Status:           Open
 Bug Type:         PHP options/info functions
 Operating System: RH 7.2
 PHP Version:      4.1.2
 New Comment:

To clarify:

1) There is no reason why variables_order should have any effect
whatsoever on whether _GET, _POST, _COOKIE, or HTTP_*_VARS are set. 
Ever.  Read the documentation on track_vars for why, but it certainly
says they can be found WITHOUT mentioning any side effects of
variables_order.  At the very least, this is a documentation bug.  At
worst (and in reality) this is a violation of the "principle of least
surprise"; that is, when does "can be found" not mean "can be found"? 
What possible use could a programmer have for disabling EGPCS variable
parsing to the extent of disabling _GET, _POST, etc.?

2) Even allowing for all the above, this should all work if the
directives are in Apache.  It doesn't.


Previous Comments:
------------------------------------------------------------------------

[2002-03-19 10:19:40] rlm@pricegrabber.com

No, it is a bug.  The problem is that if the configuration data comes
from Apache rather than /etc/php.ini, the tracking variables aren't
initialized correctly as described.

------------------------------------------------------------------------

[2002-03-19 04:19:24] sander@php.net

So it was not a bug, but a configuration problem.

------------------------------------------------------------------------

[2002-03-18 23:27:16] rlm@pricegrabber.com

Ah, I think I understand maybe why you can't replicate this.  In my
/etc/httpd/conf/include.d directory (the entire dir is parsed by Apache
on startup), I have a file that has the following lines in it, in the
order following:

    php_value variables_order "es"
    php_flag register_globals Off

Remove the file containing these lines, and it works.  Install the file
containing these lines, and it fails.

------------------------------------------------------------------------

[2002-03-18 23:14:35] rlm@pricegrabber.com

Maybe this should be registered against the RedHat distribution?  It's
100% consistent for me.

------------------------------------------------------------------------

[2002-03-18 23:03:06] rasmus@php.net

Uh, can anybody reproduce this?  I certainly can't.  HTTP_*_VARS are
definitely on for me regardless of the register_globals setting.  I
suspect user error here.

------------------------------------------------------------------------

The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
    http://bugs.php.net/16155

-- 
Edit this bug report at http://bugs.php.net/?id=16155&edit=1



Thread (21 messages)

« previous php.bugs (#2890) next »