#21015 [Asn->Fbk]: phpweb isn't register_globals safe

ID: 21015 Updated by: goba@php.net Reported By: toni dot viemero at iki dot fi -Status: Assigned +Status: Feedback Bug Type: Website problem Operating System: Irrelevant PHP Version: 4.3.0RC3 Assigned To: goba New Comment: I was working on this staff the last days, and I am getting confident that there are very few pages left (if any) which depend on register_globals. It would be nice if you would be able to check and report on it ;) Previous Comments: ------------------------------------------------------------------------ [2003-01-02 15:28:46] goba@php.net I am on this. But it is a slow process... ------------------------------------------------------------------------ [2002-12-14 13:40:07] goba@php.net I have added two functions to prepend.inc to support register_globals = off setups. Those can / will be used to enhance scripts in phpweb... ------------------------------------------------------------------------ [2002-12-14 12:43:49] goba@php.net You are somewhat right. But as you see search.php for example, it is not ideal to replace all uses of $pattern with $_REQUEST['pattern']. It is more ideal to first assign the $pattern variable the value of $_REQUEST['pattern']. I am on updating the pages, and this will probably be done on a page per page bases. Today's focus was a rewrite of the search page, which is now more logical. This rewrite also helped to start some other things, like the new code in prepend.inc to make those shorthand arrays accessible even on mirror sites with PHP version < 4.1.0. The setting you request to include on mirroring.php is of course there since some time now, but regardless of that I am at least a bit motivated to make the php.net scripts nice and register_globals = off friendly, but it's not a quick process to do that... BTW I have fixed the undefined constant problem on search.php it was just there today in my new code... => intentionally leaving this bug open, so we won't forget about it ;) ------------------------------------------------------------------------ [2002-12-14 12:31:17] toni dot viemero at iki dot fi At least on the following documents giver errors running phpweb register_globals off: include/site.inc downloads.php error/index.php $REMOTE_HOST, $DOCUMENT_ROOT, $SERVER_NAME etc. should be replaced with $_SERVER["..."] etc. Or change mirroring.php to indicate this for future mirrors ("php_value register_globals on" in virtualhost config). Surfing phpweb with error_reporting(E_ALL) errors too like this one: Use of undefined constant NO_BASE - assumed 'NO_BASE' in search.php on line 15. IMHO PHP.net website should represent itself as somehow working example of "error-free" (as in site works perfectly without needing to go backwards compatible from present php.ini default values) php coding :) ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=21015&edit=1