Bug #17633 Updated: phpinfo() divulges environment variables of user that initiates apache process

ID: 17633 Updated by: steffann@php.net Reported By: jason@l337hosting.com -Status: Open +Status: Bogus Bug Type: Unknown/Other Function Operating System: Red Hat Linux 7.3 PHP Version: 4.2.1 New Comment: This is not a PHP problem, but a generic Apache problem. Apache does not clear its environment, and because of that everything that runs under Apache can read it. This includes PHP, mod_perl, mod_python, CGI scripts, etc. The solution is not to modify PHP, but to start Apache with only the environment it needs. A possible way to do this is to modify your Apache startup script to use the 'env' command to modify the environment when starting httpd. Previous Comments: ------------------------------------------------------------------------ [2002-06-06 16:18:31] jason@l337hosting.com First, I wonder why it is necessary for php to know/share information about the system upon which it's installed like the values of environmental variables for the user that started apache. While this is a rather benign security risk, I'm a big fan of "if you don't need to know, then you don't know" when it comes to Internet security. So, it would seem prudent to disallow access to that sort of information if only because there isn't a single instance in the course of human affairs that a php script writer would have to know the PWD value of the user that started apache [hopefully] 4 months ago. ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=17633&edit=1