PHP 4.0 Bug #4928: rawurldecode is changing vars inside functions and outside functions
| From: | wico at cnh dot nl | Date: | Fri, 09 Jun 2000 13:04:21 +0000 |
| Subject: | PHP 4.0 Bug #4928: rawurldecode is changing vars inside functions and outside functions | ||
| Groups: | php.dev | ||
| Request: | Send a blank email to php-dev+get-20723@lists.php.net to get a copy of this message | ||
From: wico@cnh.nl
Operating system: linux
PHP version: 4.0 Release Candidate 2
PHP Bug Type: Scripting Engine problem
Bug description: rawurldecode is changing vars inside functions and outside functions
Try this and shiver:
<?
$AUTH_SID_KEY = "TeSt";
function Auth_Make_SID ($id, $email) {
$sid = "$id.$email";
$sid_encrypted = mcrypt_ecb(MCRYPT_3DES, $GLOBALS[AUTH_SID_KEY], $sid, MCRYPT_ENCRYPT);
$sid_done = $sid_encrypted . Auth_Make_CheckSum($sid_encrypted);
return(rawurlencode(base64_encode($sid_done)));
}
function Auth_Make_CheckSum($sid, $id) {
return(substr(MD5($sid), ($id % 8), 8));
}
function Dummy ($sid) {
echo "wico ($sid)<BR>";
$dummy = $sid;
$dummy = rawurldecode($dummy);
echo "SID4: $sid<BR>";
}
function Auth_SID_Add_to_Url ($url, $SID) {
echo "SID2 ($SID)<BR>";
dummy($SID); // BIG MISTAKE GOING HER
echo "SID3 ($SID)<BR>";
}
$SID = Auth_Make_SID(1, "wico");
echo "SID: $SID<BR>";
$url = "http://www.wico.com/plop?x=1";
Auth_SID_Add_to_Url($url, $SID);
?>
Why have SID3 and SID4 changed?
more why because sid4 should not be in reach for dummy...
something strange is going on here:
using mcrypt 2.2.7
'./configure' '--with-apache=/usr/src/apache_1.3.12/' '--with-gd'
'--with-mysql=/usr/local/mysql'
'--with-config-file-path=/usr/local/apache/conf/' '--enable-track-vars=yes'
'--with-ftp'
'--enable-trans-sid' '--disable-debug' '--with-mcrypt'