Re: why the damn phpinfo() is so talkative?

Max Derkachev wrote: > On my servers where apache/php module is installed, phpinfo() gives me all the > environment variables of the user (namely, me), who compiled it in the section > "Environment" . While apache is running in it's own sandbox 'www', all > my > environment for the moment I built php is showed. Even IRCNICK, IRCSERVER and > so on. If I pushed my ssh passphrase, I'm sure it wouild appear there too. As > the apache user is definitely not me, there are no any other ways for > phpinfo() to get those environment variables then fetch them from the php > module. I do not see any variables there that could be useful in debugging in > some way. None of them actually show the httpd daemon environment - just my > environment for the moment i built it. > And, even worse, all of them are exported to the $HTTP_ENV_VARS array. My own > PATH is merged with the Apache's user PATH and exported into > $HTTP_SERVER_VARS['PATH']. please verify that these pieces of information are _really_ in the php executeable or server module using something like strings libphp4.so | grep IRCNICK -- Hartmut Holzgraefe hartmut@six.de http://www.six.de +49-711-99091-77 Besuchen Sie uns auf der Buchmesse in Frankfurt, Halle 4.0, Stand D 1117 und auf der Systems in München , Halle C2, Stand 126