RE: [PHP-CVS] cvs: php4 /sapi/cgi cgi_main.c

Reverted the change. Would like to find a better way to do this. How did you generate an exploit? > -----Original Message----- > From: James Cox [mailto:james@blog.at] > Sent: Thursday, May 09, 2002 4:20 PM > To: Preston L. Bannister; Shane Caraveo > Cc: php-cvs@lists.php.net > Subject: RE: [PHP-CVS] cvs: php4 /sapi/cgi cgi_main.c > > > Preston, > > Basically, when Shane and I were testing, we discovered that it was > impossible to really find any one single variable/flag that could be used to > tell us the status of the CGI REDIRECT ENV, and so we could not be sure what > way the CGI was being called -- directly, like Apache, or redirected like > IIS. And we know that calling it directly causes bad things to happen. > > So, we have patched it so that any direct calls fail, unless the > CGI-REDIRECT-ENV is set automatically -- ie, in php.ini. > > Yes -- we could add a bunch of ifs for different known vars, eg, for IIS, or > for Apache signatures, but that doesn't make for nice code, and requires > updating, and is messy. > > Find something common to all of them, and add that to php.ini as the > cgi.redirect-env var. > > Apart from that, this code shouldn't be changed. it's safe, and doesn't need > to be compromised by individual cases. please revert! > > James > > > > > OK - installed PWS on my Win98 box - the one invisible to the Internet :). > > > > Just so I'm entirely clear - what am I looking for? I was looking for > > some sort of on-line discussion of the issue, but I guess I'm not looking > > in the right place. > > > > > > From: Shane Caraveo [mailto:shane@caraveo.com] > > > > > > Preston L. Bannister wrote: > > > > From: Shane Caraveo [mailto:shane@caraveo.com] > > > > > > > >>Not cool. I'm sure other servers also don't require > > force_redirect, so > > > >>do we start building a large if block checking for any server that > > > >>doesn't? Simply setting cgi.force_redirect=0 in php.ini fixes the > > > >>problem. If something more is needed, make it generic, not specific. > > > > > > > > > > > > OK - if the goal is to make default configuration do the right thing > > > > (so the guy installing PHP has less to get wrong) what would > > be generic? > > > > > > > > Pragmatically there are two web servers used by the majority of sites > > > > (Apache and IIS) so building knowledge into the code rather than into > > > > the documentation for the most common cases makes everyone's > > life simpler. > > > > > > > > I don't mind putting this into a different form. What would > > you suggest? > > > > > > Something other than checking that an environment variable has > > a secific > > > value. For Apache we don't check what the value of the vars are, but > > > that the vars exist. The advantage of this is that if the > > value changes > > > for some reason, php doesn't have to change to work with it. So find a > > > common var that is available on the majority of MS os/web server > > > combinations, and NOT common on other web servers (I beleive > > there are a > > > couple), then make the default of cgi.redirect_status_env in php.ini > > > that var name. Requires no code change. > > > > > > -- > > PHP CVS Mailing List (http://www.php.net/) > > To unsubscribe, visit: http://www.php.net/unsub.php > > > > > >