Re: WHY ????? Make PHP_AUTH_* variables not available in safe mode ...

On Mon, 7 Apr 2003, Pablo Murillo wrote: > > Are you sure it's not a register_globals issue? Try > > $_SERVER['PHP_AUTH_USER'] to get your value... > > I tryed every posible combination > >From 4.3.1 CHANGE LOG (4th point): > > - Make PHP_AUTH_* variables not available in safe mode under Apache when an > external basic auth mechanism is used. (Philip) > > Now, I'm looking at source code to try to solve this Hi there- It was decided to do this as allowing one to view the http password from external auth mechanisms is frowned upon. In fact, the documentation basically said (for years) when external auth was used, the variables wouldn't be available but in reality they were. We decided to solve this problem and concluded to disallow them when safe mode was used. This was at times a heated discussion and a compromise was reached. Note that this only affects when external auth is used, like with .htaccess Also note that you can still retrieve the username using the REMOTE_USER variable regardless of safe_mode. Just not the password. In the future this might be a ini directive but doubtful. Regards, Philip (The guy who implemented the change) References: * http://bugs.php.net/bug.php?id=20441 * http://www.php.net/features.http-auth * http://marc.theaimsgroup.com/?l=php-dev&m=104044962523961 * http://cvs.php.net/diff.php/php4/sapi/apache/Attic/mod_php4.c?sa=1&&r1=1.146&r2=1.146.2.1