Uploaded image for project: 'phpBB3'
  1. phpBB3
  2. PHPBB3-10149

deregister_globals causes error when cookie called GLOBALS is set to scalar value

    Details

    • Type: Bug
    • Status: Unverified Fix
    • Priority: Blocker
    • Resolution: Fixed
    • Affects Version/s: None
    • Fix Version/s: 3.0.9-RC1
    • Component/s: None
    • Labels:
      None
    • Environment:
      Apache/2.2.17 (Win32) PHP/5.3.4,MySQL/5.5.8

      Description

      				
      $cookie = &$_COOKIE;
      while (isset($cookie['GLOBALS']))
      {
        foreach ($cookie['GLOBALS'] as $registered_var => $value)
        {     
          if(!isset($not_unset[$registered_var]))                       
          {		
            unset($GLOBALS[$registered_var]);
          }
        }
        $cookie = &$cookie['GLOBALS'];
      }               
      

      These code inside function deregister_globals() in common.php.
      I add code

      setcookie('GLOBALS', 'TEST');
      deregister_globals();
      

      to test function deregister_globals(),and the firefox show
      Fatal error: Cannot create references to/from string offsets nor overloaded objects in D:\workspace\phpbb\common.php on line 89

        Activity

        Hide
        Oleg Oleg [X] (Inactive) added a comment -
        Show
        Oleg Oleg [X] (Inactive) added a comment - Reproduce code: http://www.phpbb.com/pastebin/view.php?paste=38
        Hide
        A_Jelly_Doughnut A_Jelly_Doughnut added a comment -

        With php 5.3.3-ubuntu9.3, I get a different result for nn-'s test case:
        [phpBB Debug] PHP Notice: in file /common.php on line 82: Invalid argument supplied for foreach()
        [phpBB Debug] PHP Notice: in file /common.php on line 82: Invalid argument supplied for foreach()
        (which are notices, and are typically suppressed)

        So, does anyone know if there was a change between 5.3.3 and 5.3.4 that might cause this particular error to become fatal? I don't see anything in the changelog.

        Show
        A_Jelly_Doughnut A_Jelly_Doughnut added a comment - With php 5.3.3-ubuntu9.3, I get a different result for nn-'s test case: [phpBB Debug] PHP Notice: in file /common.php on line 82: Invalid argument supplied for foreach() [phpBB Debug] PHP Notice: in file /common.php on line 82: Invalid argument supplied for foreach() (which are notices, and are typically suppressed) So, does anyone know if there was a change between 5.3.3 and 5.3.4 that might cause this particular error to become fatal? I don't see anything in the changelog.
        Hide
        rxu Ruslan Uzdenov added a comment -

        Again, code to reproduce:

        define('IN_PHPBB', true);
        $phpbb_root_path = (defined('PHPBB_ROOT_PATH')) ? PHPBB_ROOT_PATH : './';
        $phpEx = substr(strrchr(__FILE__, '.'), 1);
        include($phpbb_root_path . 'common.' . $phpEx);
         
        setcookie('GLOBALS', 'TEST');
        deregister_globals();
        

        Error has been generated by the code above:

        [phpBB Debug] PHP Notice: in file /common.php on line 82: Invalid argument supplied for foreach()
        [phpBB Debug] PHP Notice: in file /common.php on line 82: Invalid argument supplied for foreach()
         Fatal error: Cannot create references to/from string offsets nor overloaded objects in phpbb_root_path\common.php on line 89
        

        Show
        rxu Ruslan Uzdenov added a comment - Again, code to reproduce: define('IN_PHPBB', true); $phpbb_root_path = (defined('PHPBB_ROOT_PATH')) ? PHPBB_ROOT_PATH : './'; $phpEx = substr(strrchr(__FILE__, '.'), 1); include($phpbb_root_path . 'common.' . $phpEx);   setcookie('GLOBALS', 'TEST'); deregister_globals(); Error has been generated by the code above: [phpBB Debug] PHP Notice: in file /common.php on line 82: Invalid argument supplied for foreach() [phpBB Debug] PHP Notice: in file /common.php on line 82: Invalid argument supplied for foreach() Fatal error: Cannot create references to/from string offsets nor overloaded objects in phpbb_root_path\common.php on line 89
        Hide
        bantu Andreas Fischer added a comment -

        Add unit tests for deregister_globals().

        Show
        bantu Andreas Fischer added a comment - Add unit tests for deregister_globals().
        Hide
        naderman Nils Adermann added a comment -

        I don't even get the notice. What am I missing here? Running on PHP 5.3.3-0.dotdeb.1 with Suhosin-Patch (cli) (built: Oct 1 2010 08:49:29)

        Show
        naderman Nils Adermann added a comment - I don't even get the notice. What am I missing here? Running on PHP 5.3.3-0.dotdeb.1 with Suhosin-Patch (cli) (built: Oct 1 2010 08:49:29)
        Hide
        naderman Nils Adermann added a comment -

        Apart from that, why would you set a cookie called GLOBALS?

        Show
        naderman Nils Adermann added a comment - Apart from that, why would you set a cookie called GLOBALS?
        Hide
        bantu Andreas Fischer added a comment -

        Alternative reproduction:

        # php.ini
        error_reporting = E_ALL | E_STRICT
        display_errors = On
        display_startup_errors = On
        register_globals = On
        

        curl http://localhost/projects/phpbb3/phpBB/ --cookie "GLOBALS=test"
         
        Warning: Invalid argument supplied for foreach() in /var/www/projects/phpbb3/phpBB/common.php on line 82
        Warning: Invalid argument supplied for foreach() in /var/www/projects/phpbb3/phpBB/common.php on line 82
        Fatal error: Cannot create references to/from string offsets nor overloaded objects in /var/www/projects/phpbb3/phpBB/common.php on line 89
        

        Apart from that, why would you set a cookie called GLOBALS?

        Moot point. Nobody preventing you from sending a cookie variable named GLOBALS, thus leaking full path if php is configured as described above.

        Show
        bantu Andreas Fischer added a comment - Alternative reproduction: # php.ini error_reporting = E_ALL | E_STRICT display_errors = On display_startup_errors = On register_globals = On curl http://localhost/projects/phpbb3/phpBB/ --cookie "GLOBALS=test"   Warning: Invalid argument supplied for foreach() in /var/www/projects/phpbb3/phpBB/common.php on line 82 Warning: Invalid argument supplied for foreach() in /var/www/projects/phpbb3/phpBB/common.php on line 82 Fatal error: Cannot create references to/from string offsets nor overloaded objects in /var/www/projects/phpbb3/phpBB/common.php on line 89 Apart from that, why would you set a cookie called GLOBALS? Moot point. Nobody preventing you from sending a cookie variable named GLOBALS, thus leaking full path if php is configured as described above.
        Hide
        naderman Nils Adermann added a comment -

        Turns out suhosin was protecting me from this. I guess it filters out input variables called GLOBALS.

        Show
        naderman Nils Adermann added a comment - Turns out suhosin was protecting me from this. I guess it filters out input variables called GLOBALS.

          People

          • Assignee:
            naderman Nils Adermann
            Reporter:
            workschen workschen
          • Votes:
            0 Vote for this issue
            Watchers:
            0 Start watching this issue

            Dates

            • Created:
              Updated:
              Resolved:

              Development