Bug #1538: Security Data Lost w/ FORMS When METHOD=POST

From: alex@pog.ufl.edu Operating system: Linux 2.2.9 PHP version: 3.0.9 PHP Bug Type: Other Bug description: Security Data Lost w/ FORMS When METHOD=POST I have 2 PHP Scripts, the out put of one calls the other through a HTML FORM POST operation. The $REMOTE_USER value is null in the second script even though it is set in the first script. Both PHP Scripts are in a area of the document root where apache is configured to require authentication. Example Snippets: Script One: $inst_query = "SELECT * FROM SECURITY_SC WHERE ACCOUNT='$REMOTE_USER'"; echo $inst_query; echo "<TR><TD>\n"; echo "<FORM ACTION=optf_dlc_list.php3 METHOD=POST>\n"; echo "<INPUT TYPE=HIDDEN NAME=pog_no VALUE=$pog_no>\n"; echo "<INPUT TYPE=HIDDEN NAME=study_no VALUE=$study_no>\n"; echo "<INPUT TYPE=HIDDEN NAME=accsn_no VALUE=$accsn_no>\n"; echo "<INPUT TYPE=SUBMIT VALUE=\"View Reports\"></TD>\n"; echo "<TD>$pog_no</TD><TD>$study_no</TD><TD>$accsn_no</TD></TR>\n"; echo "</FORM>\n"; Script One Output: SELECT * FROM SECURITY_SC WHERE ACCOUNT='abrennen'; Script Two Snippet: $inst_query = "SELECT * FROM SECURITY_SC WHERE ACCOUNT='$REMOTE_USER'"; Script Two Output: SELECT * FROM SECURITY_SC WHERE ACCOUNT='' I'm running Apache 1.3.6 w/ BenSSL patch 1.3.5 and PHP 3.0.9 on Red Hat Linux 5.2 with Kernel 2.2.9 with the AC buqtraq 2.2.x patch applied. I'm using OpenSSL 0.9.3a. PHP is running as an Apache Module. I'm accessing the scripts with Netscape Communicator version 4.6 (I've tried on both Linux and Win95). Netscape does not appear to be loosing it's authentication tokens (I haven't checked but I am not asked to re-enter them when I access the PHP script which does not have the $REMOTE_USER information.) Apache CONFIG: ./configure --prefix=/www --activate-module=src/modules/php3/libphp3.a --activate-module=auth_dbm PHP CONFIG: ./configure --with-apache=../apache_1.3.6 --with-config-file-path=/etc --with-oracle=/home/vab/oracle Please let me know when this is fixed... We're developing a very large number of PHP applications for our research group in which security is very important. Thank you - PHP is an awsome product. Feel free to contact me for additional information or code. - VAB