#30849 [NEW]: example conf of README.FastCGI is not secure

From:	xuefer at 21cn dot com	Date:	Sat, 20 Nov 2004 13:22:24 +0000
Subject:	#30849 [NEW]: example conf of README.FastCGI is not secure
Groups:	php.bugs
Request:	Send a blank email to php-bugs+get-69293@lists.php.net to get a copy of this message

From:             xuefer at 21cn dot com
Operating system: win
PHP version:      4.3.9
PHP Bug Type:     CGI related
Bug description:  example conf of README.FastCGI is not secure

Description:
------------
sapi/cgi/README.FastCGI (with apache mod_fastcgi)
both ScriptAlias(dynserver) or Alias(static server) method issue a
security problem.
force_redirect is not done for fastcgi, only for cgi
this have same problem as cgi with no force_redirect
i guess redirect checking can be done after $_SERVER is ready, while cgi
use getenv.

separate php is not affected by this problem.



-- 
Edit bug report at http://bugs.php.net/?id=30849&edit=1
-- 
Try a CVS snapshot (php4):   http://bugs.php.net/fix.php?id=30849&r=trysnapshot4
Try a CVS snapshot (php5.0): http://bugs.php.net/fix.php?id=30849&r=trysnapshot50
Try a CVS snapshot (php5.1): http://bugs.php.net/fix.php?id=30849&r=trysnapshot51
Fixed in CVS:                http://bugs.php.net/fix.php?id=30849&r=fixedcvs
Fixed in release:            http://bugs.php.net/fix.php?id=30849&r=alreadyfixed
Need backtrace:              http://bugs.php.net/fix.php?id=30849&r=needtrace
Need Reproduce Script:       http://bugs.php.net/fix.php?id=30849&r=needscript
Try newer version:           http://bugs.php.net/fix.php?id=30849&r=oldversion
Not developer issue:         http://bugs.php.net/fix.php?id=30849&r=support
Expected behavior:           http://bugs.php.net/fix.php?id=30849&r=notwrong
Not enough info:             http://bugs.php.net/fix.php?id=30849&r=notenoughinfo
Submitted twice:             http://bugs.php.net/fix.php?id=30849&r=submittedtwice
register_globals:            http://bugs.php.net/fix.php?id=30849&r=globals
PHP 3 support discontinued:  http://bugs.php.net/fix.php?id=30849&r=php3
Daylight Savings:            http://bugs.php.net/fix.php?id=30849&r=dst
IIS Stability:               http://bugs.php.net/fix.php?id=30849&r=isapi
Install GNU Sed:             http://bugs.php.net/fix.php?id=30849&r=gnused
Floating point limitations:  http://bugs.php.net/fix.php?id=30849&r=float
MySQL Configuration Error:   http://bugs.php.net/fix.php?id=30849&r=mysqlcfg


   

Thread (6 messages)

• xuefer at 21cn dot comSat, 20 Nov 2004 13:22:24 +0000
  • sniper@php.netMon, 13 Dec 2004 06:51:35 +0000#30849 [Opn->Fbk]: example conf of README.FastCGI is not secure
  • xuefer at 21cn dot comMon, 13 Dec 2004 09:10:14 +0000#30849 [Fbk->Opn]: example conf of README.FastCGI is not secure
  • grange at club-internet dot frWed, 29 Dec 2004 11:16:47 +0000#30849 [Com]: example conf of README.FastCGI is not secure (or: fastcgi + force_redirect)
  • heiglandreas@php.netFri, 20 Jan 2017 20:27:43 +0000Req #30849 [Opn->Fbk]: example conf of README.FastCGI is not secure (or: fastcgi + force_redirect)
  • php-bugs at lists dot php dot netSun, 29 Jan 2017 04:22:41 +0000Req #30849 [Fbk->NoF]: example conf of README.FastCGI is not secure (or: fastcgi + force_redirect)