PHP 4.0 Bug #2994: php4 violates cgi spec regarding header output

From: jnelson@adacgeo.com Operating system: Debian GNU/Linux 2.2 PHP version: 4.0 Beta 3 PHP Bug Type: Misbehaving function Bug description: php4 violates cgi spec regarding header output The included script *should* output: Location: pop3.php3 Set-Cookie: POP3_USER=nighthawk Set-Cookie: POP3_PASS=oonoo5x Set-Cookie: POP3_SERVER=deleted; expires=Thursday, 17-Dec-98 14:39:53 GMT Content-type: text/html Which is what it does in 3.x In 4.x, it outputs: Content-Type: text/html Location: pop3.php3 Set-Cookie: POP3_USER=nighthawk Set-Cookie: POP3_PASS=oonoo5x Set-Cookie: POP3_SERVER=deleted; expires=Thursday, 17-Dec-98 14:41:01 GMT The difference is that the Content-Type header preceeds the Location header. According to CGI specification, web servers only have to parse the *first* line of output to look for one of Content-Type, Location, or Status. The Content-Type header is implied in php output, and as such, should be the *last* header output by php (after the user/script supplied headers). Note that a user may switch the content-type header by issuing header("Content-Type: blah"); In this case, php should not output any content-type header at all. Please note that the first issue is much more important than the second issue. Thanks! I will hope to determine the source-code-level cause of this bug and produce a patch. Thank you! #! /usr/local/bin/php <?php if ($fuser != "" && $fpass != "") { header("Location: pop3.php3"); setcookie("POP3_USER",$fuser,"/~jnelson/pop3/"); setcookie("POP3_PASS",$fpass,"/~jnelson/pop3/"); setcookie("POP3_SERVER",$fserver,"/~jnelson/pop3/"); exit; } else { echo "<html>\n", "<body>\n", "<form method=\"POST\">\n", "Username: <input type=\"text\" name=\"fuser\"><br>\n", "Password: <input type=\"password\" name=\"fpass\"><br>\n", "Server: <input type=\"text\" name=\"fserver\"><br>\n", "<input type=\"submit\"><br>\n", "</form>\n</body>\n</html>\n"; }