cvs: php4(PHP_4_0_7) /sapi/cgi cgi_main.c

derick Mon Mar 4 15:20:37 2002 EDT Modified files: (Branch: PHP_4_0_7) /php4/sapi/cgi cgi_main.c Log: - MFH for: fix force redirect crash under multithreaded compile should be discused: fix redirect detection to only work with apache or netscape, where we know they set an environment variable regarding redirect. IIS has no security issue here. Don't know about other windows web servers. Index: php4/sapi/cgi/cgi_main.c diff -u php4/sapi/cgi/cgi_main.c:1.133.2.1 php4/sapi/cgi/cgi_main.c:1.133.2.2 --- php4/sapi/cgi/cgi_main.c:1.133.2.1 Mon Nov 12 09:52:17 2001 +++ php4/sapi/cgi/cgi_main.c Mon Mar 4 15:20:36 2002 @@ -441,8 +441,19 @@ ap_php_optarg = orig_optarg; } +#ifdef ZTS + compiler_globals = ts_resource(compiler_globals_id); + executor_globals = ts_resource(executor_globals_id); + core_globals = ts_resource(core_globals_id); + sapi_globals = ts_resource(sapi_globals_id); + tsrm_ls = ts_resource(0); +#endif + /* startup after we get the above ini override se we get things right */ if (php_module_startup(&cgi_sapi_module)==FAILURE) { +#ifdef ZTS + tsrm_shutdown(); +#endif return FAILURE; } @@ -455,8 +466,14 @@ * http://www.koehntopp.de/php. * -- kk@netuse.de */ - if (!getenv("REDIRECT_STATUS") && !getenv ("HTTP_REDIRECT_STATUS")) { - PUTS("<b>Security Alert!</b> PHP CGI cannot be accessed directly.\n\ + if (!getenv("REDIRECT_STATUS") && !getenv ("HTTP_REDIRECT_STATUS") +#ifdef PHP_WIN32 + /* IIS doesn't set anything, look to see if php.exe is in the script_name */ + && (strstr(getenv("SERVER_SOFTWARE"),"Apache") || + strstr(getenv("SERVER_SOFTWARE"),"iPlanet")) +#endif + ) { + PUTS("<b>Security Alert!</b> PHP CGI cannot be accessed directly.\n\ \n\ <P>This PHP CGI binary was compiled with force-cgi-redirect enabled. This\n\ means that a page will only be served up if the REDIRECT_STATUS CGI variable is\n\ @@ -472,19 +489,14 @@ \n"); /* remove that detailed explanation some time */ +#ifdef ZTS + tsrm_shutdown(); +#endif return FAILURE; } } #endif /* FORCE_CGI_REDIRECT */ - -#ifdef ZTS - compiler_globals = ts_resource(compiler_globals_id); - executor_globals = ts_resource(executor_globals_id); - core_globals = ts_resource(core_globals_id); - sapi_globals = ts_resource(sapi_globals_id); - tsrm_ls = ts_resource(0); -#endif zend_first_try { if (!cgi) {