#25753 [Com]: php_value|flag / php_admin_* settings "leak" from vhosts/.htaccess files

From: Date: Mon, 23 Feb 2004 11:45:13 +0000
Subject: #25753 [Com]: php_value|flag / php_admin_* settings "leak" from vhosts/.htaccess files
References: 1  Groups: php.bugs 
Request: Send a blank email to php-bugs+get-55365@lists.php.net to get a copy of this message 
 ID:               25753
 Comment by:       schack at tdconline dot dk
 Reported By:      sniper@php.net
 Status:           Closed
 Bug Type:         Apache related
 Operating System: *
 PHP Version:      4CVS, 5CVS
 New Comment:

Why is the bug closed if the problem hasn't been solved ?
I'm also having the problem with 4.3.5rc3


Previous Comments:
------------------------------------------------------------------------

[2004-02-16 14:22:24] jg at execulink dot com

Just installed RC3, and I still have the same problem.  INI values are
leaking between virtualhosts.  

phpinfo(); PHP Version 4.3.5RC3

Warning: Unknown(): open_basedir restriction in effect.
File(/usr/ppp/p/pookie/public_html/index.php) is not within the allowed
path(s): (/usr/ppp/p/pdipietro) in Unknown on line 0

Warning: Unknown(/usr/ppp/p/pookie/public_html/index.php): failed to
open stream: Operation not permitted in Unknown on line 0

Warning: (null)(): Failed opening
'/usr/ppp/p/pookie/public_html/index.php' for inclusion
(include_path='.:/usr/share/pear') in Unknown on line 0

------------------------------------------------------------------------

[2004-02-13 12:54:51] derick@php.net

It was fixed after rc2 was released, you can either get a snapshot from
http://snaps.php.net or wait for rc3 which will be released later
today.

Derick

------------------------------------------------------------------------

[2004-02-13 12:52:07] jg at execulink dot com

This bug is supposed to be fixed it 4.3.5 ?   I installed 4.3.5RC2 and
I'm having the same problem.  open_basedir restriction on a path
specified in a different virtual host.  Virtualhost settings are
leaking between themselves.  If there is a patch for this, someone
please email me - im desperate!

------------------------------------------------------------------------

[2004-01-28 12:40:04] rasmus@php.net

This only happens on text/html files with the executable bit set.  If
the +x bit is set, we load the current ini settings and if php's
xbithack option is not set we decline the request but forget to reset
the ini settings potentially leaking them to the next request.  This is
now fixed in CVS and will be in the next release of both PHP4 and PHP5.

------------------------------------------------------------------------

[2004-01-28 00:47:04] rover at tob dot ru

We examine source files more carefull and remake a patch:

diff -udr php-4.3.3/sapi/apache/mod_php4.c
php-4.3.3.patched/sapi/apache/mod_php4.c
--- php-4.3.3/sapi/apache/mod_php4.c    2003-06-03 11:41:49.000000000
+0600
+++ php-4.3.3.patched/sapi/apache/mod_php4.c    2004-01-28
10:48:27.000000000 +0500
@@ -830,6 +830,9 @@
        }
        if(!AP(xbithack)) {
                r->allowed |= (1 << METHODS) - 1;
+               zend_try {
+                       zend_ini_deactivate(TSRMLS_C);
+               } zend_end_try();
                return DECLINED;
        }
        return send_parsed_php(r);

------------------------------------------------------------------------

The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
    http://bugs.php.net/25753

-- 
Edit this bug report at http://bugs.php.net/?id=25753&edit=1

Thread (34 messages)

« previous php.bugs (#55365) next »