PHP 4.0 Bug #3991: admin_values (like safe mode) can be overridden

From: djm@web.us.uu.net Operating system: BSD/OS 4.0.1 PHP version: 4.0 Release Candidate 1 PHP Bug Type: Misbehaving function Bug description: admin_values (like safe mode) can be overridden Security problem: PHP4 with apache 1.3.12, built as a DSO, allows "admin" values and flags (those marked PHP_INI_SYSTEM in main.c) to be reset in .htaccess files. This bug also existed in PHP4b4 with apache 1.3.9. To demonstrate the problem, in httpd.conf, set something like this: php_admin_flag safe_mode On php_admin_value doc_root "/opt/homes/web/testtest5" php_admin_value open_basedir "/opt/homes/web/testtest5" php_admin_value safe_mode_exec_dir "/opt/homes/web/testtest5/bin" (your textarea made that last line wrap) Create a phpinfo.php file under the document root containing: <?php phpinfo()?> GET phpinfo.php to verify that the settings above have been made. Now, create a .htaccess in that directory containing: php_value open_basedir "/" php_value doc_root "/" php_value safe_mode Off GET phpinfo.php again and note that the values in the .htaccess file have superceded those in the server config file. BTW, there's a related doc bug: --- apidoc-zend.txt 2000/03/31 01:55:33 1.1.1.1 +++ apidoc-zend.txt 2000/03/31 03:44:44 @@ -238,7 +238,7 @@ and "bah" respectively - note that all defaults are always given as strings. That doesn't reduce your ability to use integer values, simply specify them as strings. "foo" is marked so that it can be changed by -anyone at any time (PHP_INI_ALL), whereas "foo" is marked so it can be +anyone at any time (PHP_INI_ALL), whereas "bar" is marked so it can be changed only at startup in the php3.ini only, presumably, by the system administrator (PHP_INI_SYSTEM). When "foo" changes, no function is called. Access to it is done using the