From: mnot at pobox dot com Operating system: Mac OS X 10.3.8 PHP version: 4.3.10 PHP Bug Type: Apache related Bug description: Erroneous Allow HTTP response header
Description: ------------ When using the Apache module, PHP installs the xbithack handler for text/html. This handler make the following change to r->allowed, which is what Apache uses to populate the Allowed header on responses that require it (e.g., to OPTIONS, 405 Method Not Allowed, 501 Not Implemented); r->allowed |= (1 << METHODS) - 1; This has the affect of adding *all* known HTTP methods to the list. Effectively, PHP is telling clients that it can handle all HTTP methods, even for resources that aren't actually parsed as PHP. This is also the case in php5. Reproduce code: --------------- mnot-laptop:~> telnet localhost 80 Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. OPTIONS /index.html HTTP/1.1 Host: localhost Expected result: ---------------- HTTP/1.1 200 OK Date: Mon, 04 Apr 2005 03:12:29 GMT Server: Apache/1.3.33 (Darwin) PHP/4.3.10 Cache-Control: max-age=3600 Expires: Mon, 04 Apr 2005 04:12:29 GMT Content-Length: 0 Allow: GET, HEAD, OPTIONS, TRACE Actual result: -------------- HTTP/1.1 200 OK Date: Mon, 04 Apr 2005 03:12:29 GMT Server: Apache/1.3.33 (Darwin) PHP/4.3.10 Cache-Control: max-age=3600 Expires: Mon, 04 Apr 2005 04:12:29 GMT Content-Length: 0 Allow: GET, HEAD, POST, PUT, DELETE, CONNECT, OPTIONS, PATCH, PROPFIND, PROPPATCH, MKCOL, COPY, MOVE, LOCK, UNLOCK, TRACE -- Edit bug report at http://bugs.php.net/?id=32561&edit=1 -- Try a CVS snapshot (php4): http://bugs.php.net/fix.php?id=32561&r=trysnapshot4 Try a CVS snapshot (php5.0): http://bugs.php.net/fix.php?id=32561&r=trysnapshot50 Try a CVS snapshot (php5.1): http://bugs.php.net/fix.php?id=32561&r=trysnapshot51 Fixed in CVS: http://bugs.php.net/fix.php?id=32561&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=32561&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=32561&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=32561&r=needscript Try newer version: http://bugs.php.net/fix.php?id=32561&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=32561&r=support Expected behavior: http://bugs.php.net/fix.php?id=32561&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=32561&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=32561&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=32561&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=32561&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=32561&r=dst IIS Stability: http://bugs.php.net/fix.php?id=32561&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=32561&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=32561&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=32561&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=32561&r=mysqlcfg
