PHP 4.0 Bug #10079: Header Function Within IF construct

From: dgrimes@scvl.com Operating system: SCO OpenServer 5.0.5 PHP version: 4.0.4pl1 PHP Bug Type: Scripting Engine problem Bug description: Header Function Within IF construct <?php // Header("WWW-Authenticate: Basic realm=\"Realm\""); if (!$PHP_AUTH_USER) { exec(">xxxx"); Header("WWW-Authenticate: Basic realm=\"Realm\""); Header("HTTP/1.0 401 Unauthorized"); } else echo "else"; ?> Compiler: gcc 2.95.2 Make: GNU 3.79 FSU Pthreads: 3.8 Apache: 1.3.19 MySQL: 3.23.36 PHP: 4.0.4pl1 Freetype: 2.0 LibPNG: 1.0.9 LibJPEG: 6b Libgd: 1.8.4 PHP is compiled as an Apache module with the following options: --with-mysql --with-apache --with-pdflib --with-gd --with-trans-sid --enable-track-vars --enable-sysvsem --enable-sysvshm Description of problem: Both sides of the IF construct are being executed when testing the $PHP_AUTH_USER variable AND issuing the header function. I posted this question in the general mail list but have received any reponse from anyone....so.... Using the script list above, follow the steps shown below to produce this problem: 1. Close all instances of your browser (I am using IE-5.01 and I have not tried any other browsers). However I don't believe it is a browser issue. 2. Run the script shown above. 3. Enter some user ID and password... Everything so far works fine. 4. Look in the directory where the script is stored. There should be a file called xxxx. This indicates that $PHP_AUTH_USER was NOT set. 5. Remove the file xxxx. 6. Refresh the browser. Look for the file xxxx. Notice that xxxx is present; which should only happen if $PHP_AUTH_USER is NOT set....YET "else" was printed on screen which indicates that $PHP_AUTH_USER IS set. 7. Uncomment the commented "header" line and notice that a user ID and password prompt is always issued in this case. My questions are: 1. Why are both sides of the conditional "If (!isset($PHP_AUTH_USER))" being executed? 2. Why, when $PHP_AUTH_USER is not set, the 'exec(">xxxx")' runs on subsequent refreshes, but no prompt for a new user ID and password is issued? 3. Why, if a authenticate header is sent before testing, a user ID and password prompt is issued? Thanks for taking a look at this. Dean -- Edit Bug report at: http://bugs.php.net/?id=10079&edit=1