Re: WHY ????? Make PHP_AUTH_* variables not available in safe mode ...

On Mon, 7 Apr 2003, Pablo Murillo wrote: > > It was decided to do this as allowing one to view the http > > password from external auth mechanisms is frowned upon. > > In fact, the documentation basically said (for years) when > > external auth was used, the variables wouldn't be available > > but in reality they were. We decided to solve this problem > > and concluded to disallow them when safe mode was used. This > > was at times a heated discussion and a compromise was reached. > > > > Note that this only affects when external auth is used, like > > with .htaccess > > > > Also note that you can still retrieve the username using the > > REMOTE_USER variable regardless of safe_mode. Just not the > > password. > > > > In the future this might be a ini directive but doubtful. > > Ok, I understand, you "solved" a bug, but that BUG was nice :) > Now, going back, with this BUG solved, now, I must write a lot of innecesary > code > I was checking the source, but, I don't have the time to made test to check > if what I touched broke other things > How can I (and other with the same problem), solve this ? The only reason I got involved with the bug was because someone else "truly" fixed it by making PHP_AUTH_* unavailable if external auth was used regardless of safe mode. As one might guess, people testing PHP from CVS started noticing broken http authentication scripts so anyway here we are today. You'll notice this affected PHP all the way until the last 4.3.0 test release, RC4 iirc. This was one reason the ini solution wasn't implemented but if it's decided it's worthy of a ini setting, I assume it'll be in php5. I suppose a quick 'fix' would be to disable safe mode :) That or patching the source in which case you would remove the following from sapi/apache/mod_php4.c (or mod_php5.c): && (!PG(safe_mode) || (PG(safe_mode) && !auth_type(r))) This way PHP_AUTH_USER and PHP_AUTH_PW will always be available as they were before PHP 4.3.0. Or, use REMOTE_USER. Regards, Philip p.s. I just noticed you emailed me in private with a patch to comment the above line out, but, I'm posting this for everyone anyways :)