Skip to content

Commit 6150bf5

Browse files
haszibukka
haszi
authored and
bukka
committed
Fix url_rewriter.hosts not used for output_add_rewrite_var()
If fixes issue where session.trans_sid_hosts used instead of url_rewriter.hosts for output_add_rewrite_var(). Closes GH-13294
1 parent fd28d31 commit 6150bf5

File tree

6 files changed

+563
-4
lines changed

6 files changed

+563
-4
lines changed

‎NEWS

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -114,6 +114,8 @@ PHP NEWS
114114

115115
- Output:
116116
. Clear output handler status flags during handler initialization. (haszi)
117+
. Fixed bug with url_rewriter.hosts not used by output_add_rewrite_var().
118+
(haszi)
117119

118120
- PCRE:
119121
. Upgrade bundled pcre2lib to version 10.43. (nielsdos)

‎UPGRADING

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -412,6 +412,8 @@ PHP 8.4 UPGRADE NOTES
412412
. long2ip() now returns string instead of string|false.
413413
. The maximum precision that can be handled by round() has been extended by
414414
one digit.
415+
. output_add_rewrite_var() now uses url_rewriter.hosts instead of
416+
session.trans_sid_hosts for selecting hosts that will be rewritten.
415417

416418
========================================
417419
6. New Functions

‎ext/standard/tests/general_functions/url_rewriting_basic1.phpt

Lines changed: 154 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,154 @@
1+
--TEST--
2+
Test session and output_add_rewrite_var() URL-Rewriting independently
3+
--EXTENSIONS--
4+
session
5+
--INI--
6+
session.trans_sid_tags="a=href,area=href,frame=src,form="
7+
url_rewriter.tags="a=href,area=href,frame=src,form="
8+
--FILE--
9+
<?php
10+
$testTags = <<<TEST
11+
12+
<a href=""></a>
13+
<a href="./foo.php"></a>
14+
15+
<a href="//php.net/foo.php"></a>
16+
<a href="http://php.net/foo.php"></a>
17+
<a href="bad://php.net/foo.php"></a>
18+
<a href="//www.php.net/foo.php"></a>
19+
20+
<a href="//session-trans-sid.com/foo.php"></a>
21+
<a href="http://session-trans-sid.com/foo.php"></a>
22+
<a href="bad://session-trans-sid.com/foo.php"></a>
23+
<a href="//www.session-trans-sid.com/foo.php"></a>
24+
25+
<a href="//url-rewriter.com/foo.php"></a>
26+
<a href="http://url-rewriter.com/foo.php"></a>
27+
<a href="bad://url-rewriter.com/foo.php"></a>
28+
<a href="//www.url-rewriter.com/foo.php"></a>
29+
30+
<form action="" method="get"> </form>
31+
<form action="./foo.php" method="get"></form>
32+
33+
<form action="//php.net/foo.php" method="get"></form>
34+
<form action="http://php.net/foo.php" method="get"></form>
35+
<form action="bad://php.net/foo.php" method="get"></form>
36+
<form action="//www.php.net/foo.php" method="get"></form>
37+
38+
<form action="//session-trans-sid.com/bar.php" method="get"></form>
39+
<form action="http://session-trans-sid.com/bar.php" method="get"></form>
40+
<form action="bad://session-trans-sid.com/bar.php" method="get"></form>
41+
<form action="//www.session-trans-sid.com/bar.php" method="get"></form>
42+
43+
<form action="//url-rewriter.com/bar.php" method="get"></form>
44+
<form action="http://url-rewriter.com/bar.php" method="get"></form>
45+
<form action="bad://url-rewriter.com/bar.php" method="get"></form>
46+
<form action="//www.url-rewriter.com/bar.php" method="get"></form>
47+
48+
TEST;
49+
50+
ob_start();
51+
52+
ini_set('session.trans_sid_hosts', 'session-trans-sid.com');
53+
ini_set('url_rewriter.hosts', 'url-rewriter.com');
54+
55+
ini_set('session.use_only_cookies', 1);
56+
ini_set('session.use_cookies', 1);
57+
ini_set('session.use_strict_mode', 1);
58+
ini_set('session.use_trans_sid', 0);
59+
60+
output_add_rewrite_var('<name>', '<value>');
61+
62+
echo "URL-Rewriting with output_add_rewrite_var() without transparent session id support\n";
63+
echo $testTags;
64+
65+
ob_end_flush();
66+
67+
68+
ini_set('session.use_only_cookies', 0);
69+
ini_set('session.use_cookies', 0);
70+
ini_set('session.use_strict_mode', 0);
71+
ini_set('session.use_trans_sid', 1);
72+
73+
session_id('testid');
74+
session_start();
75+
76+
echo "\nURL-Rewriting with transparent session id support without output_add_rewrite_var()\n";
77+
echo $testTags;
78+
79+
--EXPECT--
80+
URL-Rewriting with output_add_rewrite_var() without transparent session id support
81+
82+
<a href="?%3Cname%3E=%3Cvalue%3E"></a>
83+
<a href="./foo.php?%3Cname%3E=%3Cvalue%3E"></a>
84+
85+
<a href="//php.net/foo.php"></a>
86+
<a href="http://php.net/foo.php"></a>
87+
<a href="bad://php.net/foo.php"></a>
88+
<a href="//www.php.net/foo.php"></a>
89+
90+
<a href="//session-trans-sid.com/foo.php"></a>
91+
<a href="http://session-trans-sid.com/foo.php"></a>
92+
<a href="bad://session-trans-sid.com/foo.php"></a>
93+
<a href="//www.session-trans-sid.com/foo.php"></a>
94+
95+
<a href="//url-rewriter.com/foo.php?%3Cname%3E=%3Cvalue%3E"></a>
96+
<a href="http://url-rewriter.com/foo.php?%3Cname%3E=%3Cvalue%3E"></a>
97+
<a href="bad://url-rewriter.com/foo.php"></a>
98+
<a href="//www.url-rewriter.com/foo.php"></a>
99+
100+
<form action="" method="get"><input type="hidden" name="&lt;name&gt;" value="&lt;value&gt;" /> </form>
101+
<form action="./foo.php" method="get"><input type="hidden" name="&lt;name&gt;" value="&lt;value&gt;" /></form>
102+
103+
<form action="//php.net/foo.php" method="get"></form>
104+
<form action="http://php.net/foo.php" method="get"></form>
105+
<form action="bad://php.net/foo.php" method="get"></form>
106+
<form action="//www.php.net/foo.php" method="get"></form>
107+
108+
<form action="//session-trans-sid.com/bar.php" method="get"></form>
109+
<form action="http://session-trans-sid.com/bar.php" method="get"></form>
110+
<form action="bad://session-trans-sid.com/bar.php" method="get"></form>
111+
<form action="//www.session-trans-sid.com/bar.php" method="get"></form>
112+
113+
<form action="//url-rewriter.com/bar.php" method="get"><input type="hidden" name="&lt;name&gt;" value="&lt;value&gt;" /></form>
114+
<form action="http://url-rewriter.com/bar.php" method="get"><input type="hidden" name="&lt;name&gt;" value="&lt;value&gt;" /></form>
115+
<form action="bad://url-rewriter.com/bar.php" method="get"></form>
116+
<form action="//www.url-rewriter.com/bar.php" method="get"></form>
117+
118+
URL-Rewriting with transparent session id support without output_add_rewrite_var()
119+
120+
<a href="?PHPSESSID=testid"></a>
121+
<a href="./foo.php?PHPSESSID=testid"></a>
122+
123+
<a href="//php.net/foo.php"></a>
124+
<a href="http://php.net/foo.php"></a>
125+
<a href="bad://php.net/foo.php"></a>
126+
<a href="//www.php.net/foo.php"></a>
127+
128+
<a href="//session-trans-sid.com/foo.php?PHPSESSID=testid"></a>
129+
<a href="http://session-trans-sid.com/foo.php?PHPSESSID=testid"></a>
130+
<a href="bad://session-trans-sid.com/foo.php"></a>
131+
<a href="//www.session-trans-sid.com/foo.php"></a>
132+
133+
<a href="//url-rewriter.com/foo.php"></a>
134+
<a href="http://url-rewriter.com/foo.php"></a>
135+
<a href="bad://url-rewriter.com/foo.php"></a>
136+
<a href="//www.url-rewriter.com/foo.php"></a>
137+
138+
<form action="" method="get"><input type="hidden" name="PHPSESSID" value="testid" /> </form>
139+
<form action="./foo.php" method="get"><input type="hidden" name="PHPSESSID" value="testid" /></form>
140+
141+
<form action="//php.net/foo.php" method="get"></form>
142+
<form action="http://php.net/foo.php" method="get"></form>
143+
<form action="bad://php.net/foo.php" method="get"></form>
144+
<form action="//www.php.net/foo.php" method="get"></form>
145+
146+
<form action="//session-trans-sid.com/bar.php" method="get"><input type="hidden" name="PHPSESSID" value="testid" /></form>
147+
<form action="http://session-trans-sid.com/bar.php" method="get"><input type="hidden" name="PHPSESSID" value="testid" /></form>
148+
<form action="bad://session-trans-sid.com/bar.php" method="get"></form>
149+
<form action="//www.session-trans-sid.com/bar.php" method="get"></form>
150+
151+
<form action="//url-rewriter.com/bar.php" method="get"></form>
152+
<form action="http://url-rewriter.com/bar.php" method="get"></form>
153+
<form action="bad://url-rewriter.com/bar.php" method="get"></form>
154+
<form action="//www.url-rewriter.com/bar.php" method="get"></form>

‎ext/standard/tests/general_functions/url_rewriting_basic2.phpt

Lines changed: 203 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,203 @@
1+
--TEST--
2+
Test output_add_rewrite_var() with and without nested session URL-Rewriting
3+
--EXTENSIONS--
4+
session
5+
--INI--
6+
session.trans_sid_tags="a=href,area=href,frame=src,form="
7+
url_rewriter.tags="a=href,area=href,frame=src,form="
8+
--FILE--
9+
<?php
10+
$testTags = <<<TEST
11+
12+
<a href=""></a>
13+
<a href="./foo.php"></a>
14+
15+
<a href="//php.net/foo.php"></a>
16+
<a href="http://php.net/foo.php"></a>
17+
<a href="bad://php.net/foo.php"></a>
18+
<a href="//www.php.net/foo.php"></a>
19+
20+
<a href="//session-trans-sid.com/foo.php"></a>
21+
<a href="http://session-trans-sid.com/foo.php"></a>
22+
<a href="bad://session-trans-sid.com/foo.php"></a>
23+
<a href="//www.session-trans-sid.com/foo.php"></a>
24+
25+
<a href="//url-rewriter.com/foo.php"></a>
26+
<a href="http://url-rewriter.com/foo.php"></a>
27+
<a href="bad://url-rewriter.com/foo.php"></a>
28+
<a href="//www.url-rewriter.com/foo.php"></a>
29+
30+
<form action="" method="get"> </form>
31+
<form action="./foo.php" method="get"></form>
32+
33+
<form action="//php.net/foo.php" method="get"></form>
34+
<form action="http://php.net/foo.php" method="get"></form>
35+
<form action="bad://php.net/foo.php" method="get"></form>
36+
<form action="//www.php.net/foo.php" method="get"></form>
37+
38+
<form action="//session-trans-sid.com/bar.php" method="get"></form>
39+
<form action="http://session-trans-sid.com/bar.php" method="get"></form>
40+
<form action="bad://session-trans-sid.com/bar.php" method="get"></form>
41+
<form action="//www.session-trans-sid.com/bar.php" method="get"></form>
42+
43+
<form action="//url-rewriter.com/bar.php" method="get"></form>
44+
<form action="http://url-rewriter.com/bar.php" method="get"></form>
45+
<form action="bad://url-rewriter.com/bar.php" method="get"></form>
46+
<form action="//www.url-rewriter.com/bar.php" method="get"></form>
47+
48+
TEST;
49+
50+
ob_start();
51+
52+
ini_set('session.trans_sid_hosts', 'session-trans-sid.com');
53+
ini_set('url_rewriter.hosts', 'url-rewriter.com');
54+
55+
ini_set('session.use_only_cookies', 1);
56+
ini_set('session.use_cookies', 1);
57+
ini_set('session.use_strict_mode', 0);
58+
ini_set('session.use_trans_sid', 0);
59+
60+
output_add_rewrite_var('<name>', '<value>');
61+
62+
echo "URL-Rewriting with output_add_rewrite_var() without transparent session id support\n";
63+
echo $testTags;
64+
65+
ob_flush();
66+
67+
output_reset_rewrite_vars();
68+
69+
ini_set('session.use_only_cookies', 0);
70+
ini_set('session.use_cookies', 0);
71+
ini_set('session.use_strict_mode', 0);
72+
ini_set('session.use_trans_sid', 1);
73+
74+
session_id('testid');
75+
session_start();
76+
77+
output_add_rewrite_var('<NAME>', '<VALUE>');
78+
79+
echo "\nURL-Rewriting with transparent session id support without output_add_rewrite_var()\n";
80+
echo $testTags;
81+
82+
ob_end_flush();
83+
84+
85+
output_add_rewrite_var('<name2>', '<value2>');
86+
87+
echo "\nURL-Rewriting with output_add_rewrite_var() without transparent session id support\n";
88+
echo $testTags;
89+
90+
--EXPECT--
91+
URL-Rewriting with output_add_rewrite_var() without transparent session id support
92+
93+
<a href="?%3Cname%3E=%3Cvalue%3E"></a>
94+
<a href="./foo.php?%3Cname%3E=%3Cvalue%3E"></a>
95+
96+
<a href="//php.net/foo.php"></a>
97+
<a href="http://php.net/foo.php"></a>
98+
<a href="bad://php.net/foo.php"></a>
99+
<a href="//www.php.net/foo.php"></a>
100+
101+
<a href="//session-trans-sid.com/foo.php"></a>
102+
<a href="http://session-trans-sid.com/foo.php"></a>
103+
<a href="bad://session-trans-sid.com/foo.php"></a>
104+
<a href="//www.session-trans-sid.com/foo.php"></a>
105+
106+
<a href="//url-rewriter.com/foo.php?%3Cname%3E=%3Cvalue%3E"></a>
107+
<a href="http://url-rewriter.com/foo.php?%3Cname%3E=%3Cvalue%3E"></a>
108+
<a href="bad://url-rewriter.com/foo.php"></a>
109+
<a href="//www.url-rewriter.com/foo.php"></a>
110+
111+
<form action="" method="get"><input type="hidden" name="&lt;name&gt;" value="&lt;value&gt;" /> </form>
112+
<form action="./foo.php" method="get"><input type="hidden" name="&lt;name&gt;" value="&lt;value&gt;" /></form>
113+
114+
<form action="//php.net/foo.php" method="get"></form>
115+
<form action="http://php.net/foo.php" method="get"></form>
116+
<form action="bad://php.net/foo.php" method="get"></form>
117+
<form action="//www.php.net/foo.php" method="get"></form>
118+
119+
<form action="//session-trans-sid.com/bar.php" method="get"></form>
120+
<form action="http://session-trans-sid.com/bar.php" method="get"></form>
121+
<form action="bad://session-trans-sid.com/bar.php" method="get"></form>
122+
<form action="//www.session-trans-sid.com/bar.php" method="get"></form>
123+
124+
<form action="//url-rewriter.com/bar.php" method="get"><input type="hidden" name="&lt;name&gt;" value="&lt;value&gt;" /></form>
125+
<form action="http://url-rewriter.com/bar.php" method="get"><input type="hidden" name="&lt;name&gt;" value="&lt;value&gt;" /></form>
126+
<form action="bad://url-rewriter.com/bar.php" method="get"></form>
127+
<form action="//www.url-rewriter.com/bar.php" method="get"></form>
128+
129+
URL-Rewriting with transparent session id support without output_add_rewrite_var()
130+
131+
<a href="?PHPSESSID=testid&%3CNAME%3E=%3CVALUE%3E&%3Cname2%3E=%3Cvalue2%3E"></a>
132+
<a href="./foo.php?PHPSESSID=testid&%3CNAME%3E=%3CVALUE%3E&%3Cname2%3E=%3Cvalue2%3E"></a>
133+
134+
<a href="//php.net/foo.php"></a>
135+
<a href="http://php.net/foo.php"></a>
136+
<a href="bad://php.net/foo.php"></a>
137+
<a href="//www.php.net/foo.php"></a>
138+
139+
<a href="//session-trans-sid.com/foo.php?PHPSESSID=testid"></a>
140+
<a href="http://session-trans-sid.com/foo.php?PHPSESSID=testid"></a>
141+
<a href="bad://session-trans-sid.com/foo.php"></a>
142+
<a href="//www.session-trans-sid.com/foo.php"></a>
143+
144+
<a href="//url-rewriter.com/foo.php?%3CNAME%3E=%3CVALUE%3E&%3Cname2%3E=%3Cvalue2%3E"></a>
145+
<a href="http://url-rewriter.com/foo.php?%3CNAME%3E=%3CVALUE%3E&%3Cname2%3E=%3Cvalue2%3E"></a>
146+
<a href="bad://url-rewriter.com/foo.php"></a>
147+
<a href="//www.url-rewriter.com/foo.php"></a>
148+
149+
<form action="" method="get"><input type="hidden" name="&lt;NAME&gt;" value="&lt;VALUE&gt;" /><input type="hidden" name="&lt;name2&gt;" value="&lt;value2&gt;" /><input type="hidden" name="PHPSESSID" value="testid" /> </form>
150+
<form action="./foo.php" method="get"><input type="hidden" name="&lt;NAME&gt;" value="&lt;VALUE&gt;" /><input type="hidden" name="&lt;name2&gt;" value="&lt;value2&gt;" /><input type="hidden" name="PHPSESSID" value="testid" /></form>
151+
152+
<form action="//php.net/foo.php" method="get"></form>
153+
<form action="http://php.net/foo.php" method="get"></form>
154+
<form action="bad://php.net/foo.php" method="get"></form>
155+
<form action="//www.php.net/foo.php" method="get"></form>
156+
157+
<form action="//session-trans-sid.com/bar.php" method="get"><input type="hidden" name="PHPSESSID" value="testid" /></form>
158+
<form action="http://session-trans-sid.com/bar.php" method="get"><input type="hidden" name="PHPSESSID" value="testid" /></form>
159+
<form action="bad://session-trans-sid.com/bar.php" method="get"></form>
160+
<form action="//www.session-trans-sid.com/bar.php" method="get"></form>
161+
162+
<form action="//url-rewriter.com/bar.php" method="get"><input type="hidden" name="&lt;NAME&gt;" value="&lt;VALUE&gt;" /><input type="hidden" name="&lt;name2&gt;" value="&lt;value2&gt;" /></form>
163+
<form action="http://url-rewriter.com/bar.php" method="get"><input type="hidden" name="&lt;NAME&gt;" value="&lt;VALUE&gt;" /><input type="hidden" name="&lt;name2&gt;" value="&lt;value2&gt;" /></form>
164+
<form action="bad://url-rewriter.com/bar.php" method="get"></form>
165+
<form action="//www.url-rewriter.com/bar.php" method="get"></form>
166+
167+
URL-Rewriting with output_add_rewrite_var() without transparent session id support
168+
169+
<a href="?%3CNAME%3E=%3CVALUE%3E&%3Cname2%3E=%3Cvalue2%3E"></a>
170+
<a href="./foo.php?%3CNAME%3E=%3CVALUE%3E&%3Cname2%3E=%3Cvalue2%3E"></a>
171+
172+
<a href="//php.net/foo.php"></a>
173+
<a href="http://php.net/foo.php"></a>
174+
<a href="bad://php.net/foo.php"></a>
175+
<a href="//www.php.net/foo.php"></a>
176+
177+
<a href="//session-trans-sid.com/foo.php"></a>
178+
<a href="http://session-trans-sid.com/foo.php"></a>
179+
<a href="bad://session-trans-sid.com/foo.php"></a>
180+
<a href="//www.session-trans-sid.com/foo.php"></a>
181+
182+
<a href="//url-rewriter.com/foo.php?%3CNAME%3E=%3CVALUE%3E&%3Cname2%3E=%3Cvalue2%3E"></a>
183+
<a href="http://url-rewriter.com/foo.php?%3CNAME%3E=%3CVALUE%3E&%3Cname2%3E=%3Cvalue2%3E"></a>
184+
<a href="bad://url-rewriter.com/foo.php"></a>
185+
<a href="//www.url-rewriter.com/foo.php"></a>
186+
187+
<form action="" method="get"><input type="hidden" name="&lt;NAME&gt;" value="&lt;VALUE&gt;" /><input type="hidden" name="&lt;name2&gt;" value="&lt;value2&gt;" /> </form>
188+
<form action="./foo.php" method="get"><input type="hidden" name="&lt;NAME&gt;" value="&lt;VALUE&gt;" /><input type="hidden" name="&lt;name2&gt;" value="&lt;value2&gt;" /></form>
189+
190+
<form action="//php.net/foo.php" method="get"></form>
191+
<form action="http://php.net/foo.php" method="get"></form>
192+
<form action="bad://php.net/foo.php" method="get"></form>
193+
<form action="//www.php.net/foo.php" method="get"></form>
194+
195+
<form action="//session-trans-sid.com/bar.php" method="get"></form>
196+
<form action="http://session-trans-sid.com/bar.php" method="get"></form>
197+
<form action="bad://session-trans-sid.com/bar.php" method="get"></form>
198+
<form action="//www.session-trans-sid.com/bar.php" method="get"></form>
199+
200+
<form action="//url-rewriter.com/bar.php" method="get"><input type="hidden" name="&lt;NAME&gt;" value="&lt;VALUE&gt;" /><input type="hidden" name="&lt;name2&gt;" value="&lt;value2&gt;" /></form>
201+
<form action="http://url-rewriter.com/bar.php" method="get"><input type="hidden" name="&lt;NAME&gt;" value="&lt;VALUE&gt;" /><input type="hidden" name="&lt;name2&gt;" value="&lt;value2&gt;" /></form>
202+
<form action="bad://url-rewriter.com/bar.php" method="get"></form>
203+
<form action="//www.url-rewriter.com/bar.php" method="get"></form>

0 commit comments

Comments
 (0)