Re: [PATCH] Fix for bug #31440 (GLOBALS can be by G/P/C when register_globals=On)

From:	Andi Gutmans	Date:	Tue, 15 Feb 2005 21:03:01 +0000
Subject:	Re: [PATCH] Fix for bug #31440 (GLOBALS can be by G/P/C when register_globals=On)
References:	1	Groups:	php.internals
Request:	Send a blank email to internals+get-14987@lists.php.net to get a copy of this message

Jani, Thanks for bringing this up. Will look into this. Andi At 01:39 PM 2/15/2005 +0200, Jani Taskinen wrote:

    Patch to fix is here:

        http://www.php.net/~jani/patches/bug31440.php_4_3_patch
        http://www.php.net/~jani/patches/bug31440.php_HEAD_patch

    In PHP_4_3 you can overwrite GLOBALS with these queries:

       ?GLOBALS[foo]=err or ?GLOBALS[]=foo or ?GLOBALS=foo

    In HEAD you can overwrite GLOBALS with this only:

       ?GLOBALS=foo

    I didn't investigate WHY that is the only type of query that
    "works" in HEAD branch but the same patch fixed that too.

    None of super-globals can be overwritten like this, be it
    register_globals On or Off.

    IMNSHO, GLOBALS should be "protected".
    (I don't say that this hacky patch of mine is the way, but it does the job :)

    --Jani

-- PHP Internals - PHP Runtime Development Mailing List To unsubscribe, visit: http://www.php.net/unsub.php