#27432 [Opn->Bgs]: superglobals overwriting security issue
| From: | derick@php.net | Date: | Sun, 29 Feb 2004 08:23:39 +0000 |
| Subject: | #27432 [Opn->Bgs]: superglobals overwriting security issue | ||
| References: | 1 | Groups: | php.bugs |
| Request: | Send a blank email to php-bugs+get-55691@lists.php.net to get a copy of this message | ||
ID: 27432
Updated by: derick@php.net
Reported By: nobodx at fr dot fm
-Status: Open
+Status: Bogus
Bug Type: Variables related
Operating System: win2k
PHP Version: 4.3.4
New Comment:
Thank you for taking the time to write to us, but this is not
a bug. Please double-check the documentation available at
http://www.php.net/manual/ and the instructions on how to
report
a bug at http://bugs.php.net/how-to-report.php
,
Previous Comments:
------------------------------------------------------------------------
[2004-02-28 20:12:40] nobodx at fr dot fm
Description:
------------
When register_globals=Off, people (who have no other choice) would like
to use the function import_request_variables().
But this function CAN overwrite the superglobals variables like
$_SERVER... and so users can define variables supposed to be
"protected".
Reproduce code:
---------------
<?
import_request_variables("g");
echo $_SERVER["REMOTE_ADDR"];
?>
File must be called with ?_SERVER[REMOTE_ADDR]=123
Expected result:
----------------
Expected to see my IP, not "123".
------------------------------------------------------------------------
--
Edit this bug report at http://bugs.php.net/?id=27432&edit=1