#30849 [Fbk->Opn]: example conf of README.FastCGI is not secure
ID: 30849
User updated by: xuefer at 21cn dot com
Reported By: xuefer at 21cn dot com
-Status: Feedback
+Status: Open
Bug Type: CGI related
Operating System: win
PHP Version: 4.3.9
New Comment:
the bug is, "force_redirect" is not implemented by fastcgi sapi, maybe
this is a feature request?
this lead to same issue as CGI, because both of them use ScriptAlias
afaik, ScriptAlias is good for normal cgi program, but bad for
scripting-language without "force_redirect"
using ScriptAlias
http://your-server/fcgi/php-fcgi/abc.php
have same issue as:
http://your-server/cgi-bin/php-cgi/abc.php
the only thing i can do is to use "auto_prepend_file" add a script that
check $_SERVER, for REDIRECT_STATUS. this should be better done in api
imho.
i don't know how to explain, but it's same as cgi. just
"force_redirect" don't work and i need it
Previous Comments:
------------------------------------------------------------------------
[2004-12-13 07:51:30] sniper@php.net
So where's the bug? Any patches perhaps..?
------------------------------------------------------------------------
[2004-11-20 14:22:23] xuefer at 21cn dot com
Description:
------------
sapi/cgi/README.FastCGI (with apache mod_fastcgi)
both ScriptAlias(dynserver) or Alias(static server) method issue a
security problem.
force_redirect is not done for fastcgi, only for cgi
this have same problem as cgi with no force_redirect
i guess redirect checking can be done after $_SERVER is ready, while
cgi use getenv.
separate php is not affected by this problem.
------------------------------------------------------------------------
--
Edit this bug report at http://bugs.php.net/?id=30849&edit=1
Thread (6 messages)