diff options
| -rw-r--r-- | ChangeLog | 2 | ||||
| -rw-r--r-- | ext/standard/info.c | 28 | ||||
| -rw-r--r-- | main/main.c | 4 | ||||
| -rw-r--r-- | php.ini-dist | 6 |
4 files changed, 29 insertions, 11 deletions
@@ -2,6 +2,8 @@ PHP 4.0 CHANGE LOG ChangeLog ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| ??? ?? 1999, Version 4.0 Beta 2 +- Built-in phpinfo() links are now turned off by default. They can be turned + on using the allow_builtin_links INI directive (Zeev) - Changed phpinfo() to list modules that have no info function (Zeev) - Modified array_walk() function so that the userland callback is passed a key and possible user data in addition to the value (Andrey) diff --git a/ext/standard/info.c b/ext/standard/info.c index 7cc77cc5fc..0e7d804491 100644 --- a/ext/standard/info.c +++ b/ext/standard/info.c @@ -57,6 +57,7 @@ PHPAPI void php_print_info(int flag) { char **env,*tmp1,*tmp2; char *php3_uname; + int allow_builtin_links = INI_INT("allow_builtin_links"); #if WIN32|WINNT char php3_windows_uname[256]; DWORD dwBuild=0; @@ -67,6 +68,7 @@ PHPAPI void php_print_info(int flag) ELS_FETCH(); PLS_FETCH(); SLS_FETCH(); + if (flag & PHP_INFO_GENERAL) { #if WIN32|WINNT @@ -85,11 +87,14 @@ PHPAPI void php_print_info(int flag) php_printf("<center><h1>PHP Version %s</h1></center>\n", PHP_VERSION); - PUTS("<hr><a href=\"http://www.php.net/\"><img src=\""); - if (SG(request_info).request_uri) { - PUTS(SG(request_info).request_uri); + PUTS("<hr>"); + if (allow_builtin_links) { + PUTS("<a href=\"http://www.php.net/\"><img src=\""); + if (SG(request_info).request_uri) { + PUTS(SG(request_info).request_uri); + } + PUTS("?=PHPE9568F34-D428-11d2-A769-00AA001ACF42\" border=\"0\" align=\"right\"></a>\n"); } - PUTS("?=PHPE9568F34-D428-11d2-A769-00AA001ACF42\" border=\"0\" align=\"right\"></a>\n"); php_printf("System: %s<br>Build Date: %s\n<br>", php3_uname, __DATE__); php_printf("php.ini path: %s<br>\n", CONFIGURATION_FILE_PATH); @@ -100,18 +105,21 @@ PHPAPI void php_print_info(int flag) php_printf("ZTS is undefined"); #endif /* Zend Engine */ - PUTS("<hr><a href=\"http://www.zend.com/\"><img src=\""); - if (SG(request_info).request_uri) { - PUTS(SG(request_info).request_uri); + PUTS("<hr>"); + if (allow_builtin_links) { + PUTS("<a href=\"http://www.zend.com/\"><img src=\""); + if (SG(request_info).request_uri) { + PUTS(SG(request_info).request_uri); + } + PUTS("?=PHPE9568F35-D428-11d2-A769-00AA001ACF42\" border=\"0\" align=\"right\"></a>\n"); } - PUTS("?=PHPE9568F35-D428-11d2-A769-00AA001ACF42\" border=\"0\" align=\"right\"></a>\n"); php_printf("This program makes use of the Zend scripting language engine:<br><pre>%s</pre>", get_zend_version()); - PUTS("<hr>"); } PUTS("<center>"); - if (flag & PHP_INFO_CREDITS) { + if ((flag & PHP_INFO_CREDITS) && allow_builtin_links) { + PUTS("<hr>"); PUTS("<a href=\""); if (SG(request_info).request_uri) { PUTS(SG(request_info).request_uri); diff --git a/main/main.c b/main/main.c index 8714e60ef7..89e8a5b776 100644 --- a/main/main.c +++ b/main/main.c @@ -193,6 +193,7 @@ PHP_INI_BEGIN() STD_PHP_INI_BOOLEAN("sql.safe_mode", "0", PHP_INI_SYSTEM, OnUpdateInt, sql_safe_mode, php_core_globals, core_globals) STD_PHP_INI_ENTRY("safe_mode_exec_dir", "1", PHP_INI_SYSTEM, OnUpdateString, safe_mode_exec_dir, php_core_globals, core_globals) STD_PHP_INI_BOOLEAN("enable_dl", "1", PHP_INI_SYSTEM, OnUpdateInt, enable_dl, php_core_globals, core_globals) + PHP_INI_ENTRY_EX("allow_builtin_links", "0", PHP_INI_ALL, NULL, php_ini_boolean_displayer_cb) PHP_INI_ENTRY("SMTP", "localhost", PHP_INI_ALL, NULL) PHP_INI_ENTRY("sendmail_path", DEFAULT_SENDMAIL_PATH, PHP_INI_SYSTEM, NULL) @@ -1088,7 +1089,8 @@ PHPAPI void php_execute_script(zend_file_handle *primary_file CLS_DC ELS_DC PLS_ zend_file_handle prepend_file, append_file; SLS_FETCH(); - if (SG(request_info).query_string && SG(request_info).query_string[0]=='=') { + if (SG(request_info).query_string && SG(request_info).query_string[0]=='=' + && INI_INT("allow_builtin_links")) { if (!strcmp(SG(request_info).query_string+1, "PHPE9568F34-D428-11d2-A769-00AA001ACF42")) { char *header_line = estrndup(CONTEXT_TYPE_IMAGE_GIF, sizeof(CONTEXT_TYPE_IMAGE_GIF)); diff --git a/php.ini-dist b/php.ini-dist index 7bdbf602d1..9cf6139ef6 100644 --- a/php.ini-dist +++ b/php.ini-dist @@ -48,6 +48,12 @@ highlight.keyword = #007700 highlight.bg = #FFFFFF highlight.default = #0000BB highlight.html = #000000 +; Misc +allow_builtin_links = Off ; Sets whether phpinfo() will generate built-in links that display the PHP + ; and Zend logos, and tells PHP whether to honor them or not. + ; It is no securty threat in any way, but it make sit possible + ; to determine whether you use PHP on your server or not. + ;;;;;;;;;;;;;;;;;;; |