cvs: /php4 ChangeLog main.c php.ini-dist /php4/ext/standard info.c

zeev Sat Aug 7 14:21:36 1999 EDT Modified files: /php4 ChangeLog main.c php.ini-dist /php4/ext/standard info.c Log: Built-in phpinfo() links are now turned off by default. They can be turned on using the allow_builtin_links INI directive Index: php4/ChangeLog diff -u php4/ChangeLog:1.43 php4/ChangeLog:1.44 --- php4/ChangeLog:1.43 Sat Aug 7 13:52:11 1999 +++ php4/ChangeLog Sat Aug 7 14:21:35 1999 @@ -2,6 +2,8 @@ ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| ??? ?? 1999, Version 4.0 Beta 2 +- Built-in phpinfo() links are now turned off by default. They can be turned + on using the allow_builtin_links INI directive (Zeev) - Changed phpinfo() to list modules that have no info function (Zeev) - Modified array_walk() function so that the userland callback is passed a key and possible user data in addition to the value (Andrey) Index: php4/main.c diff -u php4/main.c:1.93 php4/main.c:1.94 --- php4/main.c:1.93 Thu Aug 5 03:42:46 1999 +++ php4/main.c Sat Aug 7 14:21:35 1999 @@ -19,7 +19,7 @@ */ -/* $Id: main.c,v 1.93 1999/08/05 07:42:46 thies Exp $ */ +/* $Id: main.c,v 1.94 1999/08/07 18:21:35 zeev Exp $ */ #include <stdio.h> @@ -193,6 +193,7 @@ STD_PHP_INI_BOOLEAN("sql.safe_mode", "0", PHP_INI_SYSTEM, OnUpdateInt, sql_safe_mode, php_core_globals, core_globals) STD_PHP_INI_ENTRY("safe_mode_exec_dir", "1", PHP_INI_SYSTEM, OnUpdateString, safe_mode_exec_dir, php_core_globals, core_globals) STD_PHP_INI_BOOLEAN("enable_dl", "1", PHP_INI_SYSTEM, OnUpdateInt, enable_dl, php_core_globals, core_globals) + PHP_INI_ENTRY_EX("allow_builtin_links", "0", PHP_INI_ALL, NULL, php_ini_boolean_displayer_cb) PHP_INI_ENTRY("SMTP", "localhost", PHP_INI_ALL, NULL) PHP_INI_ENTRY("sendmail_path", DEFAULT_SENDMAIL_PATH, PHP_INI_SYSTEM, NULL) @@ -1088,7 +1089,8 @@ zend_file_handle prepend_file, append_file; SLS_FETCH(); - if (SG(request_info).query_string && SG(request_info).query_string[0]=='=') { + if (SG(request_info).query_string && SG(request_info).query_string[0]=='=' + && INI_INT("allow_builtin_links")) { if (!strcmp(SG(request_info).query_string+1, "PHPE9568F34-D428-11d2-A769-00AA001ACF42")) { char *header_line = estrndup(CONTEXT_TYPE_IMAGE_GIF, sizeof(CONTEXT_TYPE_IMAGE_GIF)); Index: php4/php.ini-dist diff -u php4/php.ini-dist:1.2 php4/php.ini-dist:1.3 --- php4/php.ini-dist:1.2 Sat Jul 17 21:00:41 1999 +++ php4/php.ini-dist Sat Aug 7 14:21:35 1999 @@ -48,6 +48,12 @@ highlight.bg = #FFFFFF highlight.default = #0000BB highlight.html = #000000 +; Misc +allow_builtin_links = Off ; Sets whether phpinfo() will generate built-in links that display the PHP + ; and Zend logos, and tells PHP whether to honor them or not. + ; It is no securty threat in any way, but it make sit possible + ; to determine whether you use PHP on your server or not. + ;;;;;;;;;;;;;;;;;;; Index: php4/ext/standard/info.c diff -u php4/ext/standard/info.c:1.29 php4/ext/standard/info.c:1.30 --- php4/ext/standard/info.c:1.29 Sat Aug 7 13:52:11 1999 +++ php4/ext/standard/info.c Sat Aug 7 14:21:35 1999 @@ -57,6 +57,7 @@ { char **env,*tmp1,*tmp2; char *php3_uname; + int allow_builtin_links = INI_INT("allow_builtin_links"); #if WIN32|WINNT char php3_windows_uname[256]; DWORD dwBuild=0; @@ -67,6 +68,7 @@ ELS_FETCH(); PLS_FETCH(); SLS_FETCH(); + if (flag & PHP_INFO_GENERAL) { #if WIN32|WINNT @@ -85,11 +87,14 @@ php_printf("<center><h1>PHP Version %s</h1></center>\n", PHP_VERSION); - PUTS("<hr><a href=\"http://www.php.net/\"><img src=\""); - if (SG(request_info).request_uri) { - PUTS(SG(request_info).request_uri); + PUTS("<hr>"); + if (allow_builtin_links) { + PUTS("<a href=\"http://www.php.net/\"><img src=\""); + if (SG(request_info).request_uri) { + PUTS(SG(request_info).request_uri); + } + PUTS("?=PHPE9568F34-D428-11d2-A769-00AA001ACF42\" border=\"0\" align=\"right\"></a>\n"); } - PUTS("?=PHPE9568F34-D428-11d2-A769-00AA001ACF42\" border=\"0\" align=\"right\"></a>\n"); php_printf("System: %s<br>Build Date: %s\n<br>", php3_uname, __DATE__); php_printf("php.ini path: %s<br>\n", CONFIGURATION_FILE_PATH); @@ -100,18 +105,21 @@ php_printf("ZTS is undefined"); #endif /* Zend Engine */ - PUTS("<hr><a href=\"http://www.zend.com/\"><img src=\""); - if (SG(request_info).request_uri) { - PUTS(SG(request_info).request_uri); + PUTS("<hr>"); + if (allow_builtin_links) { + PUTS("<a href=\"http://www.zend.com/\"><img src=\""); + if (SG(request_info).request_uri) { + PUTS(SG(request_info).request_uri); + } + PUTS("?=PHPE9568F35-D428-11d2-A769-00AA001ACF42\" border=\"0\" align=\"right\"></a>\n"); } - PUTS("?=PHPE9568F35-D428-11d2-A769-00AA001ACF42\" border=\"0\" align=\"right\"></a>\n"); php_printf("This program makes use of the Zend scripting language engine:<br><pre>%s</pre>", get_zend_version()); - PUTS("<hr>"); } PUTS("<center>"); - if (flag & PHP_INFO_CREDITS) { + if ((flag & PHP_INFO_CREDITS) && allow_builtin_links) { + PUTS("<hr>"); PUTS("<a href=\""); if (SG(request_info).request_uri) { PUTS(SG(request_info).request_uri);