From: manuel at mausz dot at
Operating system: Linux
PHP version: 4.4.7
PHP Bug Type: Apache related
Bug description: php settings leak between vhosts on apache 1.3
Description:
------------
PHP ini settings leak between different vhosts under certain
circumstances. This is reproduceable on FreeBSD and Linux (Gentoo with and
without their patchset) with Apache 1.3 and PHP4 + PHP5 running as module.
It's not reproducable with Apache 2.0.
This only occurs when putting a php_flag/value setting in a
Directory-directive, which will affected two (or more) vhosts. Please note
that the directive is totally unimportant.
Reproduce code:
---------------
(1) create test files
# cat /var/www/vhost1/dir1/index.php
<pre>
<?php
echo "register_globals: " . intval(ini_get('register_globals')) . "\n";
echo "safe_mode: " . intval(ini_get('safe_mode')) . "\n";
echo "pid: " . getmypid() . "\n";
?>
</pre>
# cat /var/www/vhost1/dir2/index.php
... same as above ...
(2) change apache settings to only fork one worker
KeepAlive Off
MinSpareServers 1
MaxSpareServers 1
StartServers 1
MaxClients 1
<Directory "/var/www/vhost1">
AllowOverride Options
php_admin_flag engine on
</Directory>
<VirtualHost *>
DocumentRoot /var/www/vhost1/dir1/
ServerName vhost1.domain.tld
php_admin_value open_basedir /var/www/vhost1/
</VirtualHost
<VirtualHost *>
DocumentRoot /var/www/vhost1/dir2/
ServerName vhost2.domain.tld
php_admin_value open_basedir /var/www/vhost1/
php_admin_value register_globals 1
</VirtualHost>
(3) open vhosts
- open vhost1
- open vhost2
- open vhost1 again
Expected result:
----------------
vhost1 (first time):
register_globals: 0
safe_mode: 0
vhost2:
register_globals: 1
safe_mode: 0
vhost1 (second time):
register_globals: 0
safe_mode: 0
Actual result:
--------------
vhost1 (first time):
register_globals: 0
safe_mode: 0
vhost2:
register_globals: 1
safe_mode: 0
vhost1 (second time):
register_globals: 1
safe_mode: 0
--
Edit bug report at http://bugs.php.net/?id=41628&edit=1
--
Try a CVS snapshot (PHP 4.4):
http://bugs.php.net/fix.php?id=41628&r=trysnapshot44
Try a CVS snapshot (PHP 5.2):
http://bugs.php.net/fix.php?id=41628&r=trysnapshot52
Try a CVS snapshot (PHP 6.0):
http://bugs.php.net/fix.php?id=41628&r=trysnapshot60
Fixed in CVS: http://bugs.php.net/fix.php?id=41628&r=fixedcvs
Fixed in release:
http://bugs.php.net/fix.php?id=41628&r=alreadyfixed
Need backtrace: http://bugs.php.net/fix.php?id=41628&r=needtrace
Need Reproduce Script: http://bugs.php.net/fix.php?id=41628&r=needscript
Try newer version: http://bugs.php.net/fix.php?id=41628&r=oldversion
Not developer issue: http://bugs.php.net/fix.php?id=41628&r=support
Expected behavior: http://bugs.php.net/fix.php?id=41628&r=notwrong
Not enough info:
http://bugs.php.net/fix.php?id=41628&r=notenoughinfo
Submitted twice:
http://bugs.php.net/fix.php?id=41628&r=submittedtwice
register_globals: http://bugs.php.net/fix.php?id=41628&r=globals
PHP 3 support discontinued: http://bugs.php.net/fix.php?id=41628&r=php3
Daylight Savings: http://bugs.php.net/fix.php?id=41628&r=dst
IIS Stability: http://bugs.php.net/fix.php?id=41628&r=isapi
Install GNU Sed: http://bugs.php.net/fix.php?id=41628&r=gnused
Floating point limitations: http://bugs.php.net/fix.php?id=41628&r=float
No Zend Extensions: http://bugs.php.net/fix.php?id=41628&r=nozend
MySQL Configuration Error: http://bugs.php.net/fix.php?id=41628&r=mysqlcfg
