#25753 [NEW]: php_value|flag / php_admin_* settings "leak" from vhosts/.htaccess files

From: Date: Sat, 04 Oct 2003 04:48:13 +0000
Subject: #25753 [NEW]: php_value|flag / php_admin_* settings "leak" from vhosts/.htaccess files
Groups: php.bugs 
Request: Send a blank email to php-bugs+get-48544@lists.php.net to get a copy of this message 
From:             sniper@php.net
Operating system: *
PHP version:      4CVS-2003-10-04 (stable)
PHP Bug Type:     Apache related
Bug description:  php_value|flag / php_admin_*  settings "leak" from vhosts/.htaccess
files

Description:
------------
If (for example) one virtualhost configuration has
set "php_admin_flag register_globals off", in some situations the setting
persists between requests.
-> php.ini settings are NOT reset between requests.

1. php.ini has register_globals = On
2. Request is made into www.foobar.com 
(which has "php_admin_flag register_globals off")
3. Next request (same apache child) is made into www.barfoo.com (which
does not have the setting)

This applies to ALL php.ini directives.

Some related reports:

bug #6374 (include_path in .htaccess across multiple vhosts)
bug #7174 (Round-robin -like values for include_path)
bug #19292 (Random error: open_basedir restriction..)
bug #21564 (corrupted paths coming to open_basedir)
bug #23462 ("php_admin_value open_basedir" in httpd.conf)
bug #23580 (Random values for include_path)
bug #24282 (Strange Open Base Dir Restriction Errors)
bug #24974 (random open_basedir errors)
bug #25172 ($HTTP_HOST sometimes empty)

For all who think they're experiencing this problem:
DO NOT add any comments here unless you have some extra information to
give which is not already given in above mentioned reports. 
Any comment which has no extra value will be deleted.



-- 
Edit bug report at http://bugs.php.net/?id=25753&edit=1
-- 
Try a CVS snapshot (php4):  http://bugs.php.net/fix.php?id=25753&r=trysnapshot4
Try a CVS snapshot (php5):  http://bugs.php.net/fix.php?id=25753&r=trysnapshot5
Fixed in CVS:               http://bugs.php.net/fix.php?id=25753&r=fixedcvs
Fixed in release:           http://bugs.php.net/fix.php?id=25753&r=alreadyfixed
Need backtrace:             http://bugs.php.net/fix.php?id=25753&r=needtrace
Try newer version:          http://bugs.php.net/fix.php?id=25753&r=oldversion
Not developer issue:        http://bugs.php.net/fix.php?id=25753&r=support
Expected behavior:          http://bugs.php.net/fix.php?id=25753&r=notwrong
Not enough info:            http://bugs.php.net/fix.php?id=25753&r=notenoughinfo
Submitted twice:            http://bugs.php.net/fix.php?id=25753&r=submittedtwice
register_globals:           http://bugs.php.net/fix.php?id=25753&r=globals
PHP 3 support discontinued: http://bugs.php.net/fix.php?id=25753&r=php3
Daylight Savings:           http://bugs.php.net/fix.php?id=25753&r=dst
IIS Stability:              http://bugs.php.net/fix.php?id=25753&r=isapi
Install GNU Sed:            http://bugs.php.net/fix.php?id=25753&r=gnused
Floating point limitations: http://bugs.php.net/fix.php?id=25753&r=float

Thread (34 messages)

« previous php.bugs (#48544) next »