#21015 [Csd->Asn]: phpweb isn't register_globals safe

ID: 21015 Updated by: goba@php.net Reported By: toni dot viemero at iki dot fi -Status: Closed +Status: Assigned Bug Type: Website problem Operating System: Irrelevant PHP Version: 4.3.0RC3 Assigned To: goba New Comment: Erm, you have probably not checked too closely. There are some pages still dependent on register globals, like the search.php and the cal.php pages. So I am not going to remove this requirement yet from the mirroring guidelines, until I have time to fix those problems too. The search stuff will need time, but until it is fixed, the URL shortcuts are not working and the search box is not functional, so it is not recommended to remove register_globals yet from the mirror config. Previous Comments: ------------------------------------------------------------------------ [2003-08-11 05:01:39] toni dot viemero at iki dot fi I removed register_globals from Apache config and everything seemed to work ok. Closing bug. ------------------------------------------------------------------------ [2003-08-09 12:10:33] goba@php.net I was working on this staff the last days, and I am getting confident that there are very few pages left (if any) which depend on register_globals. It would be nice if you would be able to check and report on it ;) ------------------------------------------------------------------------ [2003-01-02 15:28:46] goba@php.net I am on this. But it is a slow process... ------------------------------------------------------------------------ [2002-12-14 13:40:07] goba@php.net I have added two functions to prepend.inc to support register_globals = off setups. Those can / will be used to enhance scripts in phpweb... ------------------------------------------------------------------------ [2002-12-14 12:43:49] goba@php.net You are somewhat right. But as you see search.php for example, it is not ideal to replace all uses of $pattern with $_REQUEST['pattern']. It is more ideal to first assign the $pattern variable the value of $_REQUEST['pattern']. I am on updating the pages, and this will probably be done on a page per page bases. Today's focus was a rewrite of the search page, which is now more logical. This rewrite also helped to start some other things, like the new code in prepend.inc to make those shorthand arrays accessible even on mirror sites with PHP version < 4.1.0. The setting you request to include on mirroring.php is of course there since some time now, but regardless of that I am at least a bit motivated to make the php.net scripts nice and register_globals = off friendly, but it's not a quick process to do that... BTW I have fixed the undefined constant problem on search.php it was just there today in my new code... => intentionally leaving this bug open, so we won't forget about it ;) ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at http://bugs.php.net/21015 -- Edit this bug report at http://bugs.php.net/?id=21015&edit=1