Bug #17633: phpinfo() divulges environment variables of user that initiates apache process

From: jason@l337hosting.com Operating system: Red Hat Linux 7.3 PHP version: 4.2.1 PHP Bug Type: Unknown/Other Function Bug description: phpinfo() divulges environment variables of user that initiates apache process First, I wonder why it is necessary for php to know/share information about the system upon which it's installed like the values of environmental variables for the user that started apache. While this is a rather benign security risk, I'm a big fan of "if you don't need to know, then you don't know" when it comes to Internet security. So, it would seem prudent to disallow access to that sort of information if only because there isn't a single instance in the course of human affairs that a php script writer would have to know the PWD value of the user that started apache [hopefully] 4 months ago. -- Edit bug report at http://bugs.php.net/?id=17633&edit=1 -- Fixed in CVS: http://bugs.php.net/fix.php?id=17633&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=17633&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=17633&r=needtrace Try newer version: http://bugs.php.net/fix.php?id=17633&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=17633&r=support Expected behavior: http://bugs.php.net/fix.php?id=17633&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=17633&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=17633&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=17633&r=globals