[Xitami] $PHP_SELF variable

[Fabian Bess]

--------------000104020007040102070105
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit

Paul Reid wrote:

>> Since Version 2.4d5 (or d4 I'm not sure) this PHP variable which should be filled with the calling script's filename is empty. 
>>
>
>Which Version Of PHP ???
>
latest PHP 4.0.6

>The current version of PHP changed which variable it uses to find its
>script. The PHP site documents this as a security issue. Xitami does not
>(AFAIK, never did) fill this variable.
>
Well, it did on Xitami sometime and it still does with Apache.

>I had a BAT file which patched this under DOS/Win. It was posted here
>last year. Unfortunately I lost most of my older messages since then. I
>*think* the trick is to SET PATH_INFO the same as SCRIPT_PATH and then
>call PHP. 
>
Maybe you could describe this a little more in detail to me? Not on the list but in private?

-- 
Fabian Bess (webmaster@tannenhof.de)
Webmaster Drogenhilfe Tannenhof Berlin e.V. 'http://www.tannenhof.de'



--------------000104020007040102070105
Content-Type: text/html; charset=us-ascii
Content-Transfer-Encoding: 7bit

<html>
<head>
</head>
<body>
Paul Reid wrote:<br>
<blockquote type="cite" cite="mid:3BF018FF.77C316F1@rci.rutgers.edu">
  <blockquote type="cite">
    <pre wrap=""> Since Version 2.4d5 (or d4 I'm not sure) this PHP variable which should be filled with the calling script's filename is empty. <br></pre>
    </blockquote>
    <pre wrap=""><!----><br>Which Version Of PHP ???</pre>
    </blockquote>
latest PHP 4.0.6<br>
    <blockquote type="cite" cite="mid:3BF018FF.77C316F1@rci.rutgers.edu">
      <pre wrap="">The current version of PHP changed which variable it uses to find its<br>script. The PHP site documents this as a security issue. Xitami does not<br>(AFAIK, never did) fill this variable.</pre>
      </blockquote>
Well, it did on Xitami sometime and it still does with Apache.<br>
      <blockquote type="cite" cite="mid:3BF018FF.77C316F1@rci.rutgers.edu">
        <pre wrap="">I had a BAT file which patched this under DOS/Win. It was posted here<br>last year. Unfortunately I lost most of my older messages since then. I<br>*think* the trick is to SET PATH_INFO the same as SCRIPT_PATH and then<br>call PHP. <br></pre>
        </blockquote>
        <pre class="moz-signature" cols="$mailwrapcol">Maybe you could describe this a little more in detail to me? Not on the list but in private?<br><br>-- 
Fabian Bess (<a class="moz-txt-link-abbreviated" href="mailto:webmaster@tannenhof.de">webmaster@tannenhof.de</a>)
Webmaster Drogenhilfe Tannenhof Berlin e.V. '<a class="moz-txt-link-freetext" href="http://www.tannenhof.de">http://www.tannenhof.de</a>'
</pre>
        <br>
        </body>
        </html>

--------------000104020007040102070105--