From: php_public at macfreek dot nl
Operating system: Linux
PHP version: 5.1.2
PHP Bug Type: Feature/Change Request
Bug description: Option to turn off Apache subrequests for PATH_TRANSLATED
Description:
------------
The CGI 1.1 specification specifies that a request for
http://example.com/test/test.php/argument
where test.php is a PHP script
Would define
PHP_INFO: /argument
PATH_TRANSLATED: /www/htdocs/argument (asuming that /www/htdocs is the on
the document root)
Apache correctly set these variables, and PHP lists then in the _SERVER
variable, and passes them to the test.php script.
To my surprise, PHP not only executes test.php, but aparently also does an
Apache subrequest for /argument. This request is not displayed in the
access log.
However, the subrequest can be seen in the error log if / is disallowed
("deny from all" in the .htaccess file), and allowed in /test/ ("allow
from all in the /test/.htacess file).
Reproduce code:
---------------
See above. Files in the document root, with content:
/.htaccess: Order allow,deny
/test/.htaccess: allow from all
/test/test.php: <p>PHP file</p>
/test/test.txt: <p>Text file</p>
Expected result:
----------------
I would expect that a call to /test/test.php would display the contents of
the file, pass the CGI variables, and just do that, and nothing more.
Actual result:
--------------
A request to /test/test.php/argument displays the files content "<p>PHP
file</p>", as expected.
However, the Apache error log also shows "client denied by server
configuration: /www/htdocs/argument, referer:
http://www.example.com/test/test.php/argument";
I did not expect this subrequest; it does not seem necessary to make the
request. In fact, if the file does exists, and is accessible, the output
of the request does not change. So the subrequest seems spurious to me.
Feature request:
I recommend to remove the Apache subrequest (or whatever it exactly is).
If the subrequest has a purpose, I'm curious to hear the reason, and I
recommend instead to add an option to disable it. Note that the
--disable-path-info-check configuration parameter is not what I want: that
completely disables the requests with PATH_INFO. I just don't want PHP or
Apache to make a request to it.
Regression notes:
A request to /test/test.txt/argument gives and error "404 No such file
"/test/test.txt/argument". No other error is logged. This indicated that
indeed the fact that PHP makes the Apache subrequest, and not Apache
itself.
I found this behaviour when running MediaWiki, which makes use of these
kind of URL's in the form of /wiki/index.php/Article.
I'm running Apache 2.0.54
--
Edit bug report at http://bugs.php.net/?id=37247&edit=1
--
Try a CVS snapshot (PHP 4.4):
http://bugs.php.net/fix.php?id=37247&r=trysnapshot44
Try a CVS snapshot (PHP 5.1):
http://bugs.php.net/fix.php?id=37247&r=trysnapshot51
Try a CVS snapshot (PHP 6.0):
http://bugs.php.net/fix.php?id=37247&r=trysnapshot60
Fixed in CVS: http://bugs.php.net/fix.php?id=37247&r=fixedcvs
Fixed in release:
http://bugs.php.net/fix.php?id=37247&r=alreadyfixed
Need backtrace: http://bugs.php.net/fix.php?id=37247&r=needtrace
Need Reproduce Script: http://bugs.php.net/fix.php?id=37247&r=needscript
Try newer version: http://bugs.php.net/fix.php?id=37247&r=oldversion
Not developer issue: http://bugs.php.net/fix.php?id=37247&r=support
Expected behavior: http://bugs.php.net/fix.php?id=37247&r=notwrong
Not enough info:
http://bugs.php.net/fix.php?id=37247&r=notenoughinfo
Submitted twice:
http://bugs.php.net/fix.php?id=37247&r=submittedtwice
register_globals: http://bugs.php.net/fix.php?id=37247&r=globals
PHP 3 support discontinued: http://bugs.php.net/fix.php?id=37247&r=php3
Daylight Savings: http://bugs.php.net/fix.php?id=37247&r=dst
IIS Stability: http://bugs.php.net/fix.php?id=37247&r=isapi
Install GNU Sed: http://bugs.php.net/fix.php?id=37247&r=gnused
Floating point limitations: http://bugs.php.net/fix.php?id=37247&r=float
No Zend Extensions: http://bugs.php.net/fix.php?id=37247&r=nozend
MySQL Configuration Error: http://bugs.php.net/fix.php?id=37247&r=mysqlcfg
