ID:               39927
 Updated by:       [EMAIL PROTECTED]
 Reported By:      to_devnull at yahoo dot com
-Status:           Open
+Status:           Bogus
 Bug Type:         Apache related
 Operating System: all
 PHP Version:      5.2.0
 New Comment:

Thank you for taking the time to write to us, but this is not
a bug. Please double-check the documentation available at
http://www.php.net/manual/ and the instructions on how to report
a bug at http://bugs.php.net/how-to-report.php

This is legacy of register_globals, as long as it exists . and 
spaces in input var names will be converted to underscores.


Previous Comments:
------------------------------------------------------------------------

[2006-12-22 00:28:27] to_devnull at yahoo dot com

Description:
------------
I'm "reopening" Bug #13961 since some moron marked it as "bogus" and I
can't comment on it:
http://bugs.php.net/bug.php?id=13961

Apache module mod_setenvif sets variables in 
r->subprocess_env. If variable name contains character ".", then
sapi_apache_register_server_variables() will
replace it with "_". This breaks internal
variables like force-response-1.0 (php changes it to
force-response-1_0).

I hit this bug with PHP4.4.3/PHP5 and latest Apache 1.3.37. Spent
several hours tracing in debugger why "downgrade-1.0" becomes
"downgrade-1_0". This is a serious bug -- basically it's impossible to
downgrade client request/server response to HTTP 1.0 (or disable
chunking) if php is involved. What a shame!


Reproduce code:
---------------
I actually traced it by shoving a static string containing '.' in
r->subprocess_env and thus getting Apache to core dump when php tries
to write to read-only memory in php_register_variable_ex().




------------------------------------------------------------------------


-- 
Edit this bug report at http://bugs.php.net/?id=39927&edit=1

Reply via email to