RE: [PHP-CVS] How to painlessly defuse the CGI exploit.

Preston, I don't want to defuse your enthusiasm, but there are a number of points. firstly: this doesn't only apply to apache, it's just noticeable because of apache. There are thousands of web servers out there with different attitudes to CGI. The RFC for CGI states clearly how CGI is to be handled (via redirects, for security), and so the webservers that don't conform to this spec are invalid. Apache is one of them, but they choose to not change this behaviour. So, in the CGI SAPI, we choose to force redirects, and if no such process exists in the webserver, we have to implement one, by way of specifying redirect info. Yes. it doesn't make all that much sense. i know it's hard to comprehend, and believe me, it's harder to write and explain it. but from discussion with Shane, it just doesn't seem sensible to special case apache here. This functionality, albeit difficult and confusing, works. lets not change it again. James