ID: 23232
Updated by: iliaa@php.net
Reported By: raul at dias dot com dot br
-Status: Open
+Status: Feedback
Bug Type: Apache2 related
Operating System: Linux
PHP Version: 4.3.2RC1
New Comment:
Is there a reason in your patch that you are not verifying that the
authentication is basic? If my understanding is correct, then only
basic authentication is allowed when safe_mode is enabled.
Previous Comments:
------------------------------------------------------------------------
[2003-04-16 15:54:36] raul at dias dot com dot br
That patch did not work quite well.
However it helped to rewrite a new one.
This is the patch that worked:
------------------------------>8-------------------------
diff -Nru php-4.3.2RC1/sapi/apache2filter/sapi_apache2.c
php-4.3.2RC1.patch/sapi/apache2filter/sapi_apache2.c
--- php-4.3.2RC1/sapi/apache2filter/sapi_apache2.c 2003-03-05
13:12:41.000000000 -0300
+++ php-4.3.2RC1.patch/sapi/apache2filter/sapi_apache2.c 2003-04-16
12:33:00.000000000 -0300
@@ -367,6 +367,7 @@
{
char *content_type;
const char *auth;
+ const char *auth_type;
PG(during_request_startup) = 0;
SG(sapi_headers).http_response_code = 200;
@@ -387,7 +388,7 @@
apr_table_unset(f->r->headers_out, "Expires");
apr_table_unset(f->r->headers_out, "ETag");
apr_table_unset(f->r->headers_in, "Connection");
- if (!PG(safe_mode)) {
+ if (!PG(safe_mode) || (PG(safe_mode) && !(auth_type =
ap_auth_type(f->r)))) {
auth = apr_table_get(f->r->headers_in, "Authorization");
php_handle_auth_data(auth TSRMLS_CC);
} else {
diff -Nru php-4.3.2RC1/sapi/apache2handler/sapi_apache2.c
php-4.3.2RC1.patch/sapi/apache2handler/sapi_apache2.c
--- php-4.3.2RC1/sapi/apache2handler/sapi_apache2.c 2003-03-10
00:17:04.000000000 -0300
+++ php-4.3.2RC1.patch/sapi/apache2handler/sapi_apache2.c 2003-04-16
12:34:21.000000000 -0300
@@ -409,6 +409,7 @@
{
char *content_type;
const char *auth;
+ const char *auth_type;
SG(sapi_headers).http_response_code = 200;
SG(request_info).content_type = apr_table_get(r->headers_in,
"Content-Type");
@@ -426,7 +427,7 @@
apr_table_unset(r->headers_out, "Expires");
apr_table_unset(r->headers_out, "ETag");
apr_table_unset(r->headers_in, "Connection");
- if (!PG(safe_mode)) {
+ if (!PG(safe_mode) || (PG(safe_mode) && !(auth_type =
ap_auth_type(r)))) {
auth = apr_table_get(r->headers_in, "Authorization");
php_handle_auth_data(auth TSRMLS_CC);
} else {
--------------------------8<------------------------
This one now worked on a 4.3.1 php:
------------------------8<-------------------
diff -Nru php-4.3.2RC1/sapi/apache2filter/sapi_apache2.c
php-4.3.2RC1.patch/sapi/apache2filter/sapi_apache2.c
--- php-4.3.2RC1/sapi/apache2filter/sapi_apache2.c 2003-03-05
13:12:41.000000000 -0300
+++ php-4.3.2RC1.patch/sapi/apache2filter/sapi_apache2.c 2003-04-16
12:33:00.000000000 -0300
@@ -367,6 +367,7 @@
{
char *content_type;
const char *auth;
+ const char *auth_type;
PG(during_request_startup) = 0;
SG(sapi_headers).http_response_code = 200;
@@ -387,7 +388,7 @@
apr_table_unset(f->r->headers_out, "Expires");
apr_table_unset(f->r->headers_out, "ETag");
apr_table_unset(f->r->headers_in, "Connection");
- if (!PG(safe_mode)) {
+ if (!PG(safe_mode) || (PG(safe_mode) && !(auth_type =
ap_auth_type(f->r)))) {
auth = apr_table_get(f->r->headers_in, "Authorization");
php_handle_auth_data(auth TSRMLS_CC);
} else {
----------------------------->8-----------------------
I tested it with AuthType apache's authentication.
------------------------------------------------------------------------
[2003-04-15 22:52:34] raul at dias dot com dot br
Thanks.
I am compiling it, right now.
Btw, shouldn't that be applyed to apache2filter/ dir too?
------------------------------------------------------------------------
[2003-04-15 22:14:44] iliaa@php.net
Please try the patch at:
http://bb.prohost.org/ap2.txt
and let me know if it fixes the problem.
------------------------------------------------------------------------
[2003-04-15 21:22:15] raul at dias dot com dot br
When safe_mode is on PHP_AUTH_USER and PHP_AUTH_PW should set
to NULL only if there is an external authentication.
If there is no external authentication these variables should
NOT be set to NULL.
In APACHE 1.x code this is done by checking the authtype(r)
variable, which means that there is an authentication set in
either httpd.conf or a .htaccess file.
In APACHE 2.x code, there is no such checking.
If safe_mode is on those variables are NULLed without any
other type of checking for an external authentication.
I am not sure if this is a BUG or a "FEATURE", but because
of the lack of information about this in the code or
documentation, I am assuming this is a bug.
I am still not familiar with APACHE 2.x API or all
its features to suggest the best way to fix this or patch it.
------------------------------------------------------------------------
--
Edit this bug report at http://bugs.php.net/?id=23232&edit=1