unread
Patch to fix is here:
http://www.php.net/~jani/patches/bug31440.php_4_3_patch
http://www.php.net/~jani/patches/bug31440.php_HEAD_patch
In PHP_4_3 you can overwrite GLOBALS with these queries:
?GLOBALS[foo]=err or ?GLOBALS[]=foo or ?GLOBALS=foo
In HEAD you can overwrite GLOBALS with this only:
?GLOBALS=foo
I didn't investigate WHY that is the only type of query that
"works" in HEAD branch but the same patch fixed that too.
None of super-globals can be overwritten like this, be it
register_globals On or Off.
IMNSHO, GLOBALS should be "protected".
(I don't say that this hacky patch of mine is the way, but it does the job :)
--Jani
unread
Jani,
Thanks for bringing this up. Will look into this.
Andi
At 01:39 PM 2/15/2005 +0200, Jani Taskinen wrote:
Patch to fix is here: http://www.php.net/~jani/patches/bug31440.php_4_3_patch http://www.php.net/~jani/patches/bug31440.php_HEAD_patch In PHP_4_3 you can overwrite GLOBALS with these queries: ?GLOBALS[foo]=err or ?GLOBALS[]=foo or ?GLOBALS=foo In HEAD you can overwrite GLOBALS with this only: ?GLOBALS=foo I didn't investigate WHY that is the only type of query that "works" in HEAD branch but the same patch fixed that too. None of super-globals can be overwritten like this, be it register_globals On or Off. IMNSHO, GLOBALS should be "protected". (I don't say that this hacky patch of mine is the way, but it doesthe job :)
--Jani
unread
This behavior makes some sort of sense. It happens when register_globals is
on which means you are supposed to be able to access $GLOBALS[] and it
makes sense for it to stay in sync with the global variables.
Maybe $GLOBALS[] and $GLOBALS direct access are edge cases but should we
invest time and code to resolve this when we know it's a general problem
anyway?
Andi
At 01:39 PM 2/15/2005 +0200, Jani Taskinen wrote:
Patch to fix is here: http://www.php.net/~jani/patches/bug31440.php_4_3_patch http://www.php.net/~jani/patches/bug31440.php_HEAD_patch In PHP_4_3 you can overwrite GLOBALS with these queries: ?GLOBALS[foo]=err or ?GLOBALS[]=foo or ?GLOBALS=foo In HEAD you can overwrite GLOBALS with this only: ?GLOBALS=foo I didn't investigate WHY that is the only type of query that "works" in HEAD branch but the same patch fixed that too. None of super-globals can be overwritten like this, be it register_globals On or Off. IMNSHO, GLOBALS should be "protected". (I don't say that this hacky patch of mine is the way, but it doesthe job :)
--Jani