[PHP-BUG] Bug #62050 [NEW]: Default CA certificates are not loaded

2012-05-16 Thread glenn at zewt dot org
From: 
Operating system: Linux
PHP version:  5.4.3
Package:  OpenSSL related
Bug Type: Bug
Bug description:Default CA certificates are not loaded

Description:

OpenSSL CA default certificates are not loaded.  To make HTTPS certificate

verification work, I have to hardcode the path to where CA certs are on the

local system, eg:

$req = new HTTP_Request2('https://url', HTTP_Request2::METHOD_GET,
array ("ssl_capath" => "/usr/lib/ssl/certs"));

This isn't portable, and it's very unobvious; it seems that some people
"work 
around" this by disabling certificate verification, which is bad.  I don't
know 
if some distros patch around this problem, or if there's something else
going on 
for this not to happen to everybody; I'm hitting it on Debian testing and
with 
OpenSSL 1.0.1c.

In php_SSL_new_from_context, if cafile and capath are both NULL, it looks
like 
you only need to call SSL_CTX_set_default_verify_paths instead of 
SSL_CTX_load_verify_locations.  Don't call it if either are specified, so
people 
don't end up with certificates loaded when they explicitly want to load
only 
specific ones.



-- 
Edit bug report at https://bugs.php.net/bug.php?id=62050&edit=1
-- 
Try a snapshot (PHP 5.4):
https://bugs.php.net/fix.php?id=62050&r=trysnapshot54
Try a snapshot (PHP 5.3):
https://bugs.php.net/fix.php?id=62050&r=trysnapshot53
Try a snapshot (trunk):  
https://bugs.php.net/fix.php?id=62050&r=trysnapshottrunk
Fixed in SVN:
https://bugs.php.net/fix.php?id=62050&r=fixed
Fixed in SVN and need be documented: 
https://bugs.php.net/fix.php?id=62050&r=needdocs
Fixed in release:
https://bugs.php.net/fix.php?id=62050&r=alreadyfixed
Need backtrace:  
https://bugs.php.net/fix.php?id=62050&r=needtrace
Need Reproduce Script:   
https://bugs.php.net/fix.php?id=62050&r=needscript
Try newer version:   
https://bugs.php.net/fix.php?id=62050&r=oldversion
Not developer issue: 
https://bugs.php.net/fix.php?id=62050&r=support
Expected behavior:   
https://bugs.php.net/fix.php?id=62050&r=notwrong
Not enough info: 
https://bugs.php.net/fix.php?id=62050&r=notenoughinfo
Submitted twice: 
https://bugs.php.net/fix.php?id=62050&r=submittedtwice
register_globals:
https://bugs.php.net/fix.php?id=62050&r=globals
PHP 4 support discontinued:  
https://bugs.php.net/fix.php?id=62050&r=php4
Daylight Savings:https://bugs.php.net/fix.php?id=62050&r=dst
IIS Stability:   
https://bugs.php.net/fix.php?id=62050&r=isapi
Install GNU Sed: 
https://bugs.php.net/fix.php?id=62050&r=gnused
Floating point limitations:  
https://bugs.php.net/fix.php?id=62050&r=float
No Zend Extensions:  
https://bugs.php.net/fix.php?id=62050&r=nozend
MySQL Configuration Error:   
https://bugs.php.net/fix.php?id=62050&r=mysqlcfg



#49229 [Fbk->Csd]: open_basedir string gets modified...

2009-08-12 Thread glenn dot larsen at gmail dot com
 ID:   49229
 User updated by:  glenn dot larsen at gmail dot com
 Reported By:  glenn dot larsen at gmail dot com
-Status:   Feedback
+Status:   Closed
 Bug Type: Safe Mode/open_basedir
 Operating System: RHEL 5.3
 PHP Version:  5.3.0
 New Comment:

Scott is right, its a duplicate of the bug #48880.. Sorry guys


Previous Comments:


[2009-08-12 07:22:06] scott...@php.net

Please try using this snapshot:

  http://snaps.php.net/php5.3-latest.tar.gz
 
For Windows:

  http://windows.php.net/snapshots/

Pretty sure this is a duplicate of bug #48880



[2009-08-12 02:51:19] glenn dot larsen at gmail dot com

Description:

After a restart of my web server (apache 2.2.3-22), everything is
running smoothly. However, after some request (10-30 - images counted),
open_basedir gets changed... and php stops serving content, since it
thinks the page its outside the allowed path...

from my /etc/php.ini
   open_basedir = /data/customers/

this starts showing up in my log file, when php "stops" working;

[Wed Aug 12 04:38:58 2009] [error] [client xx.xx.xx.xx] PHP Warning: 
Unknown: open_basedir restriction in effect.
File(/data/customers/XX/index.php) is not within the allowed
path(s): (\xd8\xa0\xd2\ba/customers/XX/) in Unknown on line 0

... as you probably see "/data/customers/" has been replaced with
"\xd8\xa0\xd2\ba/customers/"


Reproduce code:
---
-

Expected result:

-

Actual result:
--
-





-- 
Edit this bug report at http://bugs.php.net/?id=49229&edit=1



#49229 [NEW]: open_basedir string gets modified...

2009-08-11 Thread glenn dot larsen at gmail dot com
From: glenn dot larsen at gmail dot com
Operating system: RHEL 5.3
PHP version:  5.3.0
PHP Bug Type: Safe Mode/open_basedir
Bug description:  open_basedir string gets modified...

Description:

After a restart of my web server (apache 2.2.3-22), everything is running
smoothly. However, after some request (10-30 - images counted),
open_basedir gets changed... and php stops serving content, since it thinks
the page its outside the allowed path...

from my /etc/php.ini
   open_basedir = /data/customers/

this starts showing up in my log file, when php "stops" working;

[Wed Aug 12 04:38:58 2009] [error] [client xx.xx.xx.xx] PHP Warning: 
Unknown: open_basedir restriction in effect.
File(/data/customers/XX/index.php) is not within the allowed
path(s): (\xd8\xa0\xd2\ba/customers/XX/) in Unknown on line 0

... as you probably see "/data/customers/" has been replaced with
"\xd8\xa0\xd2\ba/customers/"


Reproduce code:
---
-

Expected result:

-

Actual result:
--
-

-- 
Edit bug report at http://bugs.php.net/?id=49229&edit=1
-- 
Try a snapshot (PHP 5.2):
http://bugs.php.net/fix.php?id=49229&r=trysnapshot52
Try a snapshot (PHP 5.3):
http://bugs.php.net/fix.php?id=49229&r=trysnapshot53
Try a snapshot (PHP 6.0):
http://bugs.php.net/fix.php?id=49229&r=trysnapshot60
Fixed in SVN:
http://bugs.php.net/fix.php?id=49229&r=fixed
Fixed in SVN and need be documented: 
http://bugs.php.net/fix.php?id=49229&r=needdocs
Fixed in release:
http://bugs.php.net/fix.php?id=49229&r=alreadyfixed
Need backtrace:  
http://bugs.php.net/fix.php?id=49229&r=needtrace
Need Reproduce Script:   
http://bugs.php.net/fix.php?id=49229&r=needscript
Try newer version:   
http://bugs.php.net/fix.php?id=49229&r=oldversion
Not developer issue: 
http://bugs.php.net/fix.php?id=49229&r=support
Expected behavior:   
http://bugs.php.net/fix.php?id=49229&r=notwrong
Not enough info: 
http://bugs.php.net/fix.php?id=49229&r=notenoughinfo
Submitted twice: 
http://bugs.php.net/fix.php?id=49229&r=submittedtwice
register_globals:
http://bugs.php.net/fix.php?id=49229&r=globals
PHP 4 support discontinued:  http://bugs.php.net/fix.php?id=49229&r=php4
Daylight Savings:http://bugs.php.net/fix.php?id=49229&r=dst
IIS Stability:   
http://bugs.php.net/fix.php?id=49229&r=isapi
Install GNU Sed: 
http://bugs.php.net/fix.php?id=49229&r=gnused
Floating point limitations:  
http://bugs.php.net/fix.php?id=49229&r=float
No Zend Extensions:  
http://bugs.php.net/fix.php?id=49229&r=nozend
MySQL Configuration Error:   
http://bugs.php.net/fix.php?id=49229&r=mysqlcfg



#44267 [Com]: soap server not persistence

2008-05-18 Thread glenn at webmind dot be
 ID:   44267
 Comment by:   glenn at webmind dot be
 Reported By:  falk dot herrmann at bike24 dot net
 Status:   Open
 Bug Type: SOAP related
 Operating System: Linux 2.6.23
 PHP Version:  5.2.5
 New Comment:

Having the same problem here.


Previous Comments:


[2008-04-20 16:17:34] davy dot defaud at free dot fr

I experienced the same problem on the same version 5.2.5, for a 2.6.24
kernel both on a i586 and a x86_64 systems (but I don't think it's
system related).
I already had this problem with an old 5.0.4 PHP but my code was
working on a 5.2.1 including Suhosin so I was confident that it would
work on my brand new mandriva 2008.1 server with the latest PHP, but it
doesn't :-(
This is a really critical bug for those using PHP as a SOAP server.
We really need a quick fix.



[2008-02-27 14:25:18] falk dot herrmann at bike24 dot net

Description:

A soap server with SOAP_PERSISTENCE_SESSION is not persistence if the
class Bar extends class Foo and the class Foo was included via include()
or required().
If the class Foo is directly in the server code file (server.php), soap
server works correct.

Reproduce code:
---
server.php
==
var++;
  return $this->var;
}
  }

  $server = new SoapServer(NULL, array('uri' => 'http://localhost/'));
  $server->setClass('Bar');
  $server->setPersistence(SOAP_PERSISTENCE_SESSION);
  $server->handle();

?>

client.php
==
 "http://localhost/server.php";,
"uri" => "urn:xmethodsTest",
'trace' => 1
  ));

  # SOAP requests
  try {

$session = $client->login();

$client->__setCookie('PSESSION', $session);

print $client->incVar(); print "\n";
print $client->incVar(); print "\n";
print $client->incVar(); print "\n";
print $client->incVar(); print "\n";
print $client->incVar(); print "\n";

  } catch (SoapFault $sf) {
# ...
  }

?>

Foo.php
===


Expected result:

1
2
3
4
5


Actual result:
--
1
1
1
1
1






-- 
Edit this bug report at http://bugs.php.net/?id=44267&edit=1



#30426 [NEW]: getting a Status:302 error when trying to log in

2004-10-13 Thread glenn at gwana dot net
From: glenn at gwana dot net
Operating system: windows
PHP version:  4.3.9
PHP Bug Type: *Web Server problem
Bug description:  getting a Status:302 error when trying to log in

Description:

We set up this web address about a year ago
http://www.smginc.com/admin.php

The log in used to work. Apparently, last week, they upgraded their php.
Now when trying to log into their admin for their site they get the
following:

Status: 302
Content-type: text/html
X-Powered-By: PHP/4.3.9
Set-Cookie: smg_site_userid=1_3a108dd950a9c96fdd9404a78d65a9ae;
Max-age=86400; Version=1; Path=/
Location: admin.php?action=admin_index

The version of the old php was 4.0.20




Reproduce code:
---
http://www.smginc.com/nph-login.php

http://www.smginc.com/login.php

Expected result:

expected result would be that the log in works correctly.

It appears that when they installed the newest version of php, that may
have messed things up and I don't know what to do?




-- 
Edit bug report at http://bugs.php.net/?id=30426&edit=1
-- 
Try a CVS snapshot (php4):   http://bugs.php.net/fix.php?id=30426&r=trysnapshot4
Try a CVS snapshot (php5.0): http://bugs.php.net/fix.php?id=30426&r=trysnapshot50
Try a CVS snapshot (php5.1): http://bugs.php.net/fix.php?id=30426&r=trysnapshot51
Fixed in CVS:http://bugs.php.net/fix.php?id=30426&r=fixedcvs
Fixed in release:http://bugs.php.net/fix.php?id=30426&r=alreadyfixed
Need backtrace:  http://bugs.php.net/fix.php?id=30426&r=needtrace
Need Reproduce Script:   http://bugs.php.net/fix.php?id=30426&r=needscript
Try newer version:   http://bugs.php.net/fix.php?id=30426&r=oldversion
Not developer issue: http://bugs.php.net/fix.php?id=30426&r=support
Expected behavior:   http://bugs.php.net/fix.php?id=30426&r=notwrong
Not enough info: http://bugs.php.net/fix.php?id=30426&r=notenoughinfo
Submitted twice: http://bugs.php.net/fix.php?id=30426&r=submittedtwice
register_globals:http://bugs.php.net/fix.php?id=30426&r=globals
PHP 3 support discontinued:  http://bugs.php.net/fix.php?id=30426&r=php3
Daylight Savings:http://bugs.php.net/fix.php?id=30426&r=dst
IIS Stability:   http://bugs.php.net/fix.php?id=30426&r=isapi
Install GNU Sed: http://bugs.php.net/fix.php?id=30426&r=gnused
Floating point limitations:  http://bugs.php.net/fix.php?id=30426&r=float
MySQL Configuration Error:   http://bugs.php.net/fix.php?id=30426&r=mysqlcfg


#4641 [Com]: After some time without a paricolar reason php craches with "access violation"

2003-02-10 Thread glenn
 ID:   4641
 Comment by:   [EMAIL PROTECTED]
 Reported By:  [EMAIL PROTECTED]
 Status:   Closed
 Bug Type: Reproducible Crash
 Operating System: winNT 4.01
 PHP Version:  4.0 Release Candidate 2
 New Comment:

btw I am using version 4.3 compiled on 01/07/2003 at 17:30.


Previous Comments:


[2003-02-10 18:28:38] [EMAIL PROTECTED]

I am having the same issue.  The error I get is:

PHP has encountered an Access Violation at 16940303

If I refresh the page, it comes up fine.  However, each time a new PHP
page is accessed the message reappears.  If I restart the server, the
error messages stop.  After some time, however, the error messages
start reoccurring.



[2000-07-26 05:30:10] [EMAIL PROTECTED]

Please try the current php release.  If the bug re-occurs, please
submit a new bug report.  Also note that the ISAPI version is less
stable than the CGI version.

Thanks



[2000-05-27 11:48:31] [EMAIL PROTECTED]


After some time depending on site visits the ISAPI filter crashes with
access violation error. There's no particular reason: with normal
"echo" outputs, connection to mysql... After some time the errors
become so often that all pages that uses php replays an access
violation.




-- 
Edit this bug report at http://bugs.php.net/?id=4641&edit=1




#4641 [Com]: After some time without a paricolar reason php craches with "access violation"

2003-02-10 Thread glenn
 ID:   4641
 Comment by:   [EMAIL PROTECTED]
 Reported By:  [EMAIL PROTECTED]
 Status:   Closed
 Bug Type: Reproducible Crash
 Operating System: winNT 4.01
 PHP Version:  4.0 Release Candidate 2
 New Comment:

I am having the same issue.  The error I get is:

PHP has encountered an Access Violation at 16940303

If I refresh the page, it comes up fine.  However, each time a new PHP
page is accessed the message reappears.  If I restart the server, the
error messages stop.  After some time, however, the error messages
start reoccurring.


Previous Comments:


[2000-07-26 05:30:10] [EMAIL PROTECTED]

Please try the current php release.  If the bug re-occurs, please
submit a new bug report.  Also note that the ISAPI version is less
stable than the CGI version.

Thanks



[2000-05-27 11:48:31] [EMAIL PROTECTED]


After some time depending on site visits the ISAPI filter crashes with
access violation error. There's no particular reason: with normal
"echo" outputs, connection to mysql... After some time the errors
become so often that all pages that uses php replays an access
violation.




-- 
Edit this bug report at http://bugs.php.net/?id=4641&edit=1




#20142 [Bgs]: Session and EscapeShellCmd problem

2003-01-22 Thread glenn
 ID:   20142
 User updated by:  [EMAIL PROTECTED]
 Reported By:  [EMAIL PROTECTED]
 Status:   Bogus
 Bug Type: Session related
 Operating System: Win 2K
 PHP Version:  4.2.3
 New Comment:

The EscapeShellCmd was not the problem.  The issue was with how
sessions are stored.  Please read the post for Oct 28, 2002 for a full
explanation.  In a nutshell: The session is saved with a number
indicating the length of the variable, however it does not count the /
as a character and is thus one less than the actual number of
characters in the string, thus confusing the session information and
reporting an error.


Previous Comments:


[2003-01-22 17:48:57] [EMAIL PROTECTED]

Thank you for taking the time to write to us, but this is not
a bug. Please double-check the documentation available at
http://www.php.net/manual/ and the instructions on how to report
a bug at http://bugs.php.net/how-to-report.php

EscapeShellCmd adds \ to the variable, which changes $test from b'lah
to b\'lah nothing buggy or unusual about that.



[2002-11-25 16:08:21] [EMAIL PROTECTED]

I have installed the win32 version listed above and still get the same
problem.

The session count of characters is still off.



[2002-11-15 01:37:51] [EMAIL PROTECTED]

let's keep this in feedback status then until we get the real
feedback.




[2002-11-14 20:41:55] [EMAIL PROTECTED]

I tried using the http://snaps.php.net/win32/php4-win32-latest.zip
download, but it crashed my system.  I don't think it was the software.
 It was more likely the hardware.  I am currently rebuilding the server
and will try again when it is up.  Thank you.



[2002-11-14 01:47:41] [EMAIL PROTECTED]

No feedback was provided. The bug is being suspended because
we assume that you are no longer experiencing the problem.
If this is not the case and you are able to provide the
information that was requested earlier, please do so and
change the status of the bug back to "Open". Thank you.





The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
http://bugs.php.net/20142

-- 
Edit this bug report at http://bugs.php.net/?id=20142&edit=1




#20142 [Com]: Session and EscapeShellCmd problem

2002-11-25 Thread glenn
 ID:   20142
 Comment by:   [EMAIL PROTECTED]
 Reported By:  [EMAIL PROTECTED]
 Status:   Feedback
 Bug Type: Session related
 Operating System: Win 2K
 PHP Version:  4.2.3
 New Comment:

I have installed the win32 version listed above and still get the same
problem.

The session count of characters is still off.


Previous Comments:


[2002-11-15 01:37:51] [EMAIL PROTECTED]

let's keep this in feedback status then until we get the real
feedback.




[2002-11-14 20:41:55] [EMAIL PROTECTED]

I tried using the http://snaps.php.net/win32/php4-win32-latest.zip
download, but it crashed my system.  I don't think it was the software.
 It was more likely the hardware.  I am currently rebuilding the server
and will try again when it is up.  Thank you.



[2002-11-14 01:47:41] [EMAIL PROTECTED]

No feedback was provided. The bug is being suspended because
we assume that you are no longer experiencing the problem.
If this is not the case and you are able to provide the
information that was requested earlier, please do so and
change the status of the bug back to "Open". Thank you.





[2002-10-28 17:46:17] [EMAIL PROTECTED]

Please try using this CVS snapshot:

  http://snaps.php.net/php4-latest.tar.gz
 
For Windows:
 
  http://snaps.php.net/win32/php4-win32-latest.zip



[2002-10-28 16:00:30] [EMAIL PROTECTED]

I am using sessions with variables that have passed through
EscapeShellCmd().  The EscapeShellCmd function does its job well and
appends a \ before each special character.  I am also using user
defined session handlers with session_set_save_handler().  Listed below
is my script that executes the session_set_save_handler function along
with all the functions for the session handlers.  The problem occurs
when PHP inserts or updates a value to the session database that has
gone through the EscapeShellCmd function and escaped any special
characters.  The session separator value counts the backslashes even
though they are not posted.  For instance:

/***/
// If I set a variable 
$test = “b’lah”;
// And then run the EscapeShellCmd function
$test = EscapeShellCmd($test);
// and then register it as a session variable
session_register(“test”);
// then print the variable to see what it looks like
print $test;# This outputs: b\’lah
/***/

It adds the session, but counts the backslash as part of the session
separator so that the session variable looks something like this: 

test|s:6:"b'lah";

when it should read:

test|s:5:"b'lah";

Because it says 6, the count of characters is off and all of the
session variables become damaged.

If this is not a bug, and there is an easy solution to this please let
me know, and I apologize for posting here.  I have asked around and am
unable to find an answer.

Thank you for your time and effort.

-Glenn DeVore

P.S. Below is my session handlers script.


/***/
// This is the session handler script page
/***/

include("error.inc");
include("db.inc");

// The database connection
// $connection;

// The global variable that holds the table name
// $session_table;

// Returns current time as a number.
// Used for recording the last session access.
//
if (!function_exists('getMicroTime')) {
function getMicroTime()
{
  // microtime() returns the number of seconds
  // since 0:00:00 January 1, 1970 GMT as a
  // microsecond part and a second part.
  // eg: 0.08344800 1000952237
  // Convert the two parts into an array
  $mtime = explode(" ", microtime());

  // Return the addition of the two parts
  // eg: 1000952237.08344800
  return($mtime[1] + $mtime[0]);
}
}


// The session open handler called by PHP whenever
// a session is initialized. Always returns true.
//
if (!function_exists('sessionOpen')) {
function sessionOpen($database_name, $table_name)
{

  // Save the database name in a global variable
  global $connection;
  global $hostName;
  global $username;
  global $password;
  global $session_table;

  if (!($connection = @ mysql_pconnect($hostName,
   $username,
   $password)))
 showerror();

  if (!mysql_select_db($database_name, $connection))
 showerror();

  // Save the table name in a global variable
  $session_table = $table_name;

  retu

#20142 [NoF->Opn]: Session and EscapeShellCmd problem

2002-11-14 Thread glenn
 ID:   20142
 User updated by:  [EMAIL PROTECTED]
 Reported By:  [EMAIL PROTECTED]
-Status:   No Feedback
+Status:   Open
 Bug Type: Session related
 Operating System: Win 2K
 PHP Version:  4.2.3
 New Comment:

I tried using the http://snaps.php.net/win32/php4-win32-latest.zip
download, but it crashed my system.  I don't think it was the software.
 It was more likely the hardware.  I am currently rebuilding the server
and will try again when it is up.  Thank you.


Previous Comments:


[2002-11-14 01:47:41] [EMAIL PROTECTED]

No feedback was provided. The bug is being suspended because
we assume that you are no longer experiencing the problem.
If this is not the case and you are able to provide the
information that was requested earlier, please do so and
change the status of the bug back to "Open". Thank you.





[2002-10-28 17:46:17] [EMAIL PROTECTED]

Please try using this CVS snapshot:

  http://snaps.php.net/php4-latest.tar.gz
 
For Windows:
 
  http://snaps.php.net/win32/php4-win32-latest.zip



[2002-10-28 16:00:30] [EMAIL PROTECTED]

I am using sessions with variables that have passed through
EscapeShellCmd().  The EscapeShellCmd function does its job well and
appends a \ before each special character.  I am also using user
defined session handlers with session_set_save_handler().  Listed below
is my script that executes the session_set_save_handler function along
with all the functions for the session handlers.  The problem occurs
when PHP inserts or updates a value to the session database that has
gone through the EscapeShellCmd function and escaped any special
characters.  The session separator value counts the backslashes even
though they are not posted.  For instance:

/***/
// If I set a variable 
$test = “b’lah”;
// And then run the EscapeShellCmd function
$test = EscapeShellCmd($test);
// and then register it as a session variable
session_register(“test”);
// then print the variable to see what it looks like
print $test;# This outputs: b\’lah
/***/

It adds the session, but counts the backslash as part of the session
separator so that the session variable looks something like this: 

test|s:6:"b'lah";

when it should read:

test|s:5:"b'lah";

Because it says 6, the count of characters is off and all of the
session variables become damaged.

If this is not a bug, and there is an easy solution to this please let
me know, and I apologize for posting here.  I have asked around and am
unable to find an answer.

Thank you for your time and effort.

-Glenn DeVore

P.S. Below is my session handlers script.


/***/
// This is the session handler script page
/***/

include("error.inc");
include("db.inc");

// The database connection
// $connection;

// The global variable that holds the table name
// $session_table;

// Returns current time as a number.
// Used for recording the last session access.
//
if (!function_exists('getMicroTime')) {
function getMicroTime()
{
  // microtime() returns the number of seconds
  // since 0:00:00 January 1, 1970 GMT as a
  // microsecond part and a second part.
  // eg: 0.08344800 1000952237
  // Convert the two parts into an array
  $mtime = explode(" ", microtime());

  // Return the addition of the two parts
  // eg: 1000952237.08344800
  return($mtime[1] + $mtime[0]);
}
}


// The session open handler called by PHP whenever
// a session is initialized. Always returns true.
//
if (!function_exists('sessionOpen')) {
function sessionOpen($database_name, $table_name)
{

  // Save the database name in a global variable
  global $connection;
  global $hostName;
  global $username;
  global $password;
  global $session_table;

  if (!($connection = @ mysql_pconnect($hostName,
   $username,
   $password)))
 showerror();

  if (!mysql_select_db($database_name, $connection))
 showerror();

  // Save the table name in a global variable
  $session_table = $table_name;

  return true;
}
}
// This function is called whenever a session_start()
// call is made and reads the session variables
// Returns "" when a session is not found
// (serialized)string - session exists
//
if (!function_exists('sessionRead')) {
function sessionRead($sess_id)
{
  // Access the DBMS connection
  global $connection;

  // Access the global variable that holds 

#20142 [NEW]: Session and EscapeShellCmd problem

2002-10-28 Thread glenn
From: [EMAIL PROTECTED]
Operating system: Win 2K
PHP version:  4.2.3
PHP Bug Type: Session related
Bug description:  Session and EscapeShellCmd problem

I am using sessions with variables that have passed through
EscapeShellCmd().  The EscapeShellCmd function does its job well and
appends a \ before each special character.  I am also using user defined
session handlers with session_set_save_handler().  Listed below is my
script that executes the session_set_save_handler function along with all
the functions for the session handlers.  The problem occurs when PHP
inserts or updates a value to the session database that has gone through
the EscapeShellCmd function and escaped any special characters.  The
session separator value counts the backslashes even though they are not
posted.  For instance:

/***/
// If I set a variable 
$test = “b’lah”;
// And then run the EscapeShellCmd function
$test = EscapeShellCmd($test);
// and then register it as a session variable
session_register(“test”);
// then print the variable to see what it looks like
print $test;# This outputs: b\’lah
/***/

It adds the session, but counts the backslash as part of the session
separator so that the session variable looks something like this: 

test|s:6:"b'lah";

when it should read:

test|s:5:"b'lah";

Because it says 6, the count of characters is off and all of the session
variables become damaged.

If this is not a bug, and there is an easy solution to this please let me
know, and I apologize for posting here.  I have asked around and am unable
to find an answer.

Thank you for your time and effort.

-Glenn DeVore

P.S. Below is my session handlers script.


/***/
// This is the session handler script page
/***/

include("error.inc");
include("db.inc");

// The database connection
// $connection;

// The global variable that holds the table name
// $session_table;

// Returns current time as a number.
// Used for recording the last session access.
//
if (!function_exists('getMicroTime')) {
function getMicroTime()
{
  // microtime() returns the number of seconds
  // since 0:00:00 January 1, 1970 GMT as a
  // microsecond part and a second part.
  // eg: 0.08344800 1000952237
  // Convert the two parts into an array
  $mtime = explode(" ", microtime());

  // Return the addition of the two parts
  // eg: 1000952237.08344800
  return($mtime[1] + $mtime[0]);
}
}


// The session open handler called by PHP whenever
// a session is initialized. Always returns true.
//
if (!function_exists('sessionOpen')) {
function sessionOpen($database_name, $table_name)
{

  // Save the database name in a global variable
  global $connection;
  global $hostName;
  global $username;
  global $password;
  global $session_table;

  if (!($connection = @ mysql_pconnect($hostName,
   $username,
   $password)))
 showerror();

  if (!mysql_select_db($database_name, $connection))
 showerror();

  // Save the table name in a global variable
  $session_table = $table_name;

  return true;
}
}
// This function is called whenever a session_start()
// call is made and reads the session variables
// Returns "" when a session is not found
// (serialized)string - session exists
//
if (!function_exists('sessionRead')) {
function sessionRead($sess_id)
{
  // Access the DBMS connection
  global $connection;

  // Access the global variable that holds the name
  // of the table that holds the session variables
  global $session_table;

  // Formulate a query to find the session
  // identified by $sess_id
  $search_query =
"SELECT * FROM $session_table
  WHERE session_id = '$sess_id'";

  // Execute the query
  if (!($result = @ mysql_query($search_query,
$connection)))
 showerror();

  if(mysql_num_rows($result) == 0)
// No session found - return an empty string
return "";
  else
  {
// Found a session - return the serialized string
$row = mysql_fetch_array($result);
return $row["session_variable"];
  }
}
}

// This function is called when a session is initialized
// with a session_start() call, when variables are
// registered or unregistered, and when session variables
// are modified. Returns true on success.
//
if (!function_exists('sessionWrite')) {
function sessionWrite($sess_id, $val)
{
  global $connection;
  global $session_table;

  $time_stamp = getMicroTime();

  $search_query =
&