From: arekm at pld-linux dot org
Operating system: Linux 2.4/2.6 + glibc 2.3.2
PHP version: 4.3.4
PHP Bug Type: Output Control
Bug description: safe_mode breaks authorization via header() in 4.3.5RC2, too
Description:
------------
The problem is that when safe_mode = On and we have simple script:
<?php
header('WWW-Authenticate: Basic realm=\"log in\"');
header('HTTP/1.0 401 Unauthorized');
exit;
?>
and I get
3 Server: Apache/2.0.48 (Unix) mod_fastcgi/2.4.2 mod_ssl/2.0.48
OpenSSL/0.9.7c DAV/2
4 X-Powered-By: PHP/4.3.5RC2
5 WWW-Authenticate: 1000
which is unknown authentication method for any browser.
According to documentation
(http://pl2.php.net/manual/en/features.safe-mode.functions.php) UID should
be appended to user specified string.
Tested in on different setups like apache 1.3.29+php 4.3.3, php 4.3.4,
apache 2.0.48+php 4.3.5RC2 in fastcgi mode, without fastcgi mode. Always
reproducible.
Turning safe_mode = Off fixes problem of course.
Reproduce code:
---------------
See description.
Expected result:
----------------
3 Server: Apache/2.0.48 (Unix) mod_fastcgi/2.4.2 mod_ssl/2.0.48
OpenSSL/0.9.7c DAV/2
4 X-Powered-By: PHP/4.3.5RC2
5 WWW-Authenticate: Basic realm=\"log in\"
+ somehwere UID since that's safe mode.
Actual result:
--------------
3 Server: Apache/2.0.48 (Unix) mod_fastcgi/2.4.2 mod_ssl/2.0.48
OpenSSL/0.9.7c DAV/2
4 X-Powered-By: PHP/4.3.5RC2
5 WWW-Authenticate: 1000
--
Edit bug report at http://bugs.php.net/?id=27530&edit=1
--
Try a CVS snapshot (php4): http://bugs.php.net/fix.php?id=27530&r=trysnapshot4
Try a CVS snapshot (php5): http://bugs.php.net/fix.php?id=27530&r=trysnapshot5
Fixed in CVS: http://bugs.php.net/fix.php?id=27530&r=fixedcvs
Fixed in release: http://bugs.php.net/fix.php?id=27530&r=alreadyfixed
Need backtrace: http://bugs.php.net/fix.php?id=27530&r=needtrace
Need Reproduce Script: http://bugs.php.net/fix.php?id=27530&r=needscript
Try newer version: http://bugs.php.net/fix.php?id=27530&r=oldversion
Not developer issue: http://bugs.php.net/fix.php?id=27530&r=support
Expected behavior: http://bugs.php.net/fix.php?id=27530&r=notwrong
Not enough info: http://bugs.php.net/fix.php?id=27530&r=notenoughinfo
Submitted twice: http://bugs.php.net/fix.php?id=27530&r=submittedtwice
register_globals: http://bugs.php.net/fix.php?id=27530&r=globals
PHP 3 support discontinued: http://bugs.php.net/fix.php?id=27530&r=php3
Daylight Savings: http://bugs.php.net/fix.php?id=27530&r=dst
IIS Stability: http://bugs.php.net/fix.php?id=27530&r=isapi
Install GNU Sed: http://bugs.php.net/fix.php?id=27530&r=gnused
Floating point limitations: http://bugs.php.net/fix.php?id=27530&r=float
