cvs: /php4 main.c php_globals.h php_variables.c

zeev Sat Feb 26 08:37:27 2000 EDT Modified files: /php4 main.c php_globals.h php_variables.c Log: @- The various $HTTP_*_VARS[] are now protected, and cannot be manipulated by @ user input (Zeev) This patch is untested! I'll only have time to test it thoroughly in a couple of hours... Index: php4/main.c diff -u php4/main.c:1.219 php4/main.c:1.220 --- php4/main.c:1.219 Sat Feb 26 07:36:23 2000 +++ php4/main.c Sat Feb 26 08:36:57 2000 @@ -19,7 +19,7 @@ */ -/* $Id: main.c,v 1.219 2000/02/26 15:36:23 zeev Exp $ */ +/* $Id: main.c,v 1.220 2000/02/26 16:36:57 zeev Exp $ */ #include <stdio.h> @@ -918,7 +918,7 @@ ALLOC_ZVAL(array_ptr); array_init(array_ptr); INIT_PZVAL(array_ptr); - zend_hash_add_ptr(&EG(symbol_table), "HTTP_SERVER_VARS", sizeof("HTTP_SERVER_VARS"), array_ptr, sizeof(pval *),NULL); + PG(http_globals).server = array_ptr; } /* Server variables */ @@ -956,6 +956,8 @@ php_import_environment_variables(ELS_C PLS_CC); } + PG(http_globals).post = PG(http_globals).get = PG(http_globals).cookie = PG(http_globals).server = PG(http_globals).environment = NULL; + while(*p) { switch(*p++) { case 'p': @@ -994,6 +996,22 @@ } break; } + } + + if (PG(http_globals).post) { + zend_hash_add_ptr(&EG(symbol_table), "HTTP_POST_VARS", sizeof("HTTP_POST_VARS"), PG(http_globals).post, sizeof(zval *), NULL); + } + if (PG(http_globals).get) { + zend_hash_add_ptr(&EG(symbol_table), "HTTP_GET_VARS", sizeof("HTTP_GET_VARS"), PG(http_globals).get, sizeof(zval *), NULL); + } + if (PG(http_globals).cookie) { + zend_hash_add_ptr(&EG(symbol_table), "HTTP_COOKIE_VARS", sizeof("HTTP_COOKIE_VARS"), PG(http_globals).cookie, sizeof(zval *), NULL); + } + if (PG(http_globals).server) { + zend_hash_add_ptr(&EG(symbol_table), "HTTP_SERVER_VARS", sizeof("HTTP_SERVER_VARS"), PG(http_globals).server, sizeof(zval *), NULL); + } + if (PG(http_globals).environment) { + zend_hash_add_ptr(&EG(symbol_table), "HTTP_ENV_VARS", sizeof("HTTP_ENV_VARS"), PG(http_globals).environment, sizeof(zval *), NULL); } Index: php4/php_globals.h diff -u php4/php_globals.h:1.43 php4/php_globals.h:1.44 --- php4/php_globals.h:1.43 Fri Feb 25 13:27:02 2000 +++ php4/php_globals.h Sat Feb 26 08:36:57 2000 @@ -42,6 +42,14 @@ extern ZEND_API struct _php_core_globals core_globals; #endif +typedef struct _php_http_globals { + zval *post; + zval *get; + zval *cookie; + zval *server; + zval *environment; +} php_http_globals; + struct _php_tick_function_entry; struct _php_core_globals { @@ -100,6 +108,8 @@ unsigned char header_is_being_sent; zend_llist tick_functions; + + php_http_globals http_globals; }; Index: php4/php_variables.c diff -u php4/php_variables.c:1.9 php4/php_variables.c:1.10 --- php4/php_variables.c:1.9 Mon Feb 21 04:13:27 2000 +++ php4/php_variables.c Sat Feb 26 08:36:57 2000 @@ -226,16 +226,15 @@ INIT_PZVAL(array_ptr); switch (arg) { case PARSE_POST: - zend_hash_add_ptr(&EG(symbol_table), "HTTP_POST_VARS", sizeof("HTTP_POST_VARS"), array_ptr, sizeof(pval *),NULL); + PG(http_globals).post = array_ptr; break; case PARSE_GET: - zend_hash_add_ptr(&EG(symbol_table), "HTTP_GET_VARS", sizeof("HTTP_GET_VARS"), array_ptr, sizeof(pval *),NULL); + PG(http_globals).get = array_ptr; break; case PARSE_COOKIE: - zend_hash_add_ptr(&EG(symbol_table), "HTTP_COOKIE_VARS", sizeof("HTTP_COOKIE_VARS"), array_ptr, sizeof(pval *),NULL); + PG(http_globals).cookie = array_ptr; break; } - array_ptr->refcount++; /* If someone overwrites us, array_ptr must stay valid */ } else { array_ptr=NULL; } @@ -247,9 +246,6 @@ if (arg==PARSE_POST) { sapi_handle_post(array_ptr SLS_CC); - if (array_ptr) { - zval_ptr_dtor(&array_ptr); - } return; } @@ -275,9 +271,6 @@ } if (!res) { - if (array_ptr) { - zval_ptr_dtor(&array_ptr); - } return; } @@ -307,9 +300,6 @@ if (free_buffer) { efree(res); } - if (array_ptr) { - zval_ptr_dtor(&array_ptr); - } } @@ -323,7 +313,7 @@ ALLOC_ZVAL(array_ptr); array_init(array_ptr); INIT_PZVAL(array_ptr); - zend_hash_add_ptr(&EG(symbol_table), "HTTP_ENV_VARS", sizeof("HTTP_ENV_VARS"), array_ptr, sizeof(pval *),NULL); + PG(http_globals).environment = array_ptr; } for (env = environ; env != NULL && *env != NULL; env++) {