xref: /PHP-5.4/main/php_variables.c (revision 03be9833)
1 /*
2    +----------------------------------------------------------------------+
3    | PHP Version 5                                                        |
4    +----------------------------------------------------------------------+
5    | Copyright (c) 1997-2014 The PHP Group                                |
6    +----------------------------------------------------------------------+
7    | This source file is subject to version 3.01 of the PHP license,      |
8    | that is bundled with this package in the file LICENSE, and is        |
9    | available through the world-wide-web at the following url:           |
10    | http://www.php.net/license/3_01.txt                                  |
11    | If you did not receive a copy of the PHP license and are unable to   |
12    | obtain it through the world-wide-web, please send a note to          |
13    | license@php.net so we can mail you a copy immediately.               |
14    +----------------------------------------------------------------------+
15    | Authors: Rasmus Lerdorf <rasmus@lerdorf.on.ca>                       |
16    |          Zeev Suraski <zeev@zend.com>                                |
17    +----------------------------------------------------------------------+
18  */
19 
20 /* $Id$ */
21 
22 #include <stdio.h>
23 #include "php.h"
24 #include "ext/standard/php_standard.h"
25 #include "ext/standard/credits.h"
26 #include "php_variables.h"
27 #include "php_globals.h"
28 #include "php_content_types.h"
29 #include "SAPI.h"
30 #include "php_logos.h"
31 #include "zend_globals.h"
32 
33 /* for systems that need to override reading of environment variables */
34 void _php_import_environment_variables(zval *array_ptr TSRMLS_DC);
35 PHPAPI void (*php_import_environment_variables)(zval *array_ptr TSRMLS_DC) = _php_import_environment_variables;
36 
php_register_variable(char * var,char * strval,zval * track_vars_array TSRMLS_DC)37 PHPAPI void php_register_variable(char *var, char *strval, zval *track_vars_array TSRMLS_DC)
38 {
39 	php_register_variable_safe(var, strval, strlen(strval), track_vars_array TSRMLS_CC);
40 }
41 
42 /* binary-safe version */
php_register_variable_safe(char * var,char * strval,int str_len,zval * track_vars_array TSRMLS_DC)43 PHPAPI void php_register_variable_safe(char *var, char *strval, int str_len, zval *track_vars_array TSRMLS_DC)
44 {
45 	zval new_entry;
46 	assert(strval != NULL);
47 
48 	/* Prepare value */
49 	Z_STRLEN(new_entry) = str_len;
50 	Z_STRVAL(new_entry) = estrndup(strval, Z_STRLEN(new_entry));
51 	Z_TYPE(new_entry) = IS_STRING;
52 
53 	php_register_variable_ex(var, &new_entry, track_vars_array TSRMLS_CC);
54 }
55 
php_register_variable_ex(char * var_name,zval * val,zval * track_vars_array TSRMLS_DC)56 PHPAPI void php_register_variable_ex(char *var_name, zval *val, zval *track_vars_array TSRMLS_DC)
57 {
58 	char *p = NULL;
59 	char *ip = NULL;		/* index pointer */
60 	char *index;
61 	char *var, *var_orig;
62 	int var_len, index_len;
63 	zval *gpc_element, **gpc_element_p;
64 	zend_bool is_array = 0;
65 	HashTable *symtable1 = NULL;
66 	ALLOCA_FLAG(use_heap)
67 
68 	assert(var_name != NULL);
69 
70 	if (track_vars_array) {
71 		symtable1 = Z_ARRVAL_P(track_vars_array);
72 	}
73 
74 	if (!symtable1) {
75 		/* Nothing to do */
76 		zval_dtor(val);
77 		return;
78 	}
79 
80 
81 	/* ignore leading spaces in the variable name */
82 	while (*var_name && *var_name==' ') {
83 		var_name++;
84 	}
85 
86 	/*
87 	 * Prepare variable name
88 	 */
89 	var_len = strlen(var_name);
90 	var = var_orig = do_alloca(var_len + 1, use_heap);
91 	memcpy(var_orig, var_name, var_len + 1);
92 
93 	/* ensure that we don't have spaces or dots in the variable name (not binary safe) */
94 	for (p = var; *p; p++) {
95 		if (*p == ' ' || *p == '.') {
96 			*p='_';
97 		} else if (*p == '[') {
98 			is_array = 1;
99 			ip = p;
100 			*p = 0;
101 			break;
102 		}
103 	}
104 	var_len = p - var;
105 
106 	if (var_len==0) { /* empty variable name, or variable name with a space in it */
107 		zval_dtor(val);
108 		free_alloca(var_orig, use_heap);
109 		return;
110 	}
111 
112 	/* GLOBALS hijack attempt, reject parameter */
113 	if (symtable1 == EG(active_symbol_table) &&
114 		var_len == sizeof("GLOBALS")-1 &&
115 		!memcmp(var, "GLOBALS", sizeof("GLOBALS")-1)) {
116 		zval_dtor(val);
117 		free_alloca(var_orig, use_heap);
118 		return;
119 	}
120 
121 	index = var;
122 	index_len = var_len;
123 
124 	if (is_array) {
125 		int nest_level = 0;
126 		while (1) {
127 			char *index_s;
128 			int new_idx_len = 0;
129 
130 			if(++nest_level > PG(max_input_nesting_level)) {
131 				HashTable *ht;
132 				/* too many levels of nesting */
133 
134 				if (track_vars_array) {
135 					ht = Z_ARRVAL_P(track_vars_array);
136 					zend_symtable_del(ht, var, var_len + 1);
137 				}
138 
139 				zval_dtor(val);
140 
141 				/* do not output the error message to the screen,
142 				 this helps us to to avoid "information disclosure" */
143 				if (!PG(display_errors)) {
144 					php_error_docref(NULL TSRMLS_CC, E_WARNING, "Input variable nesting level exceeded %ld. To increase the limit change max_input_nesting_level in php.ini.", PG(max_input_nesting_level));
145 				}
146 				free_alloca(var_orig, use_heap);
147 				return;
148 			}
149 
150 			ip++;
151 			index_s = ip;
152 			if (isspace(*ip)) {
153 				ip++;
154 			}
155 			if (*ip==']') {
156 				index_s = NULL;
157 			} else {
158 				ip = strchr(ip, ']');
159 				if (!ip) {
160 					/* PHP variables cannot contain '[' in their names, so we replace the character with a '_' */
161 					*(index_s - 1) = '_';
162 
163 					index_len = 0;
164 					if (index) {
165 						index_len = strlen(index);
166 					}
167 					goto plain_var;
168 					return;
169 				}
170 				*ip = 0;
171 				new_idx_len = strlen(index_s);
172 			}
173 
174 			if (!index) {
175 				MAKE_STD_ZVAL(gpc_element);
176 				array_init(gpc_element);
177 				if (zend_hash_next_index_insert(symtable1, &gpc_element, sizeof(zval *), (void **) &gpc_element_p) == FAILURE) {
178 					zval_ptr_dtor(&gpc_element);
179 					zval_dtor(val);
180 					free_alloca(var_orig, use_heap);
181 					return;
182 				}
183 			} else {
184 				if (zend_symtable_find(symtable1, index, index_len + 1, (void **) &gpc_element_p) == FAILURE
185 					|| Z_TYPE_PP(gpc_element_p) != IS_ARRAY) {
186 					MAKE_STD_ZVAL(gpc_element);
187 					array_init(gpc_element);
188 					zend_symtable_update(symtable1, index, index_len + 1, &gpc_element, sizeof(zval *), (void **) &gpc_element_p);
189 				}
190 			}
191 			symtable1 = Z_ARRVAL_PP(gpc_element_p);
192 			/* ip pointed to the '[' character, now obtain the key */
193 			index = index_s;
194 			index_len = new_idx_len;
195 
196 			ip++;
197 			if (*ip == '[') {
198 				is_array = 1;
199 				*ip = 0;
200 			} else {
201 				goto plain_var;
202 			}
203 		}
204 	} else {
205 plain_var:
206 		MAKE_STD_ZVAL(gpc_element);
207 		gpc_element->value = val->value;
208 		Z_TYPE_P(gpc_element) = Z_TYPE_P(val);
209 		if (!index) {
210 			if (zend_hash_next_index_insert(symtable1, &gpc_element, sizeof(zval *), (void **) &gpc_element_p) == FAILURE) {
211 				zval_ptr_dtor(&gpc_element);
212 			}
213 		} else {
214 			/*
215 			 * According to rfc2965, more specific paths are listed above the less specific ones.
216 			 * If we encounter a duplicate cookie name, we should skip it, since it is not possible
217 			 * to have the same (plain text) cookie name for the same path and we should not overwrite
218 			 * more specific cookies with the less specific ones.
219 			 */
220 			if (PG(http_globals)[TRACK_VARS_COOKIE] &&
221 				symtable1 == Z_ARRVAL_P(PG(http_globals)[TRACK_VARS_COOKIE]) &&
222 				zend_symtable_exists(symtable1, index, index_len + 1)) {
223 				zval_ptr_dtor(&gpc_element);
224 			} else {
225 				zend_symtable_update(symtable1, index, index_len + 1, &gpc_element, sizeof(zval *), (void **) &gpc_element_p);
226 			}
227 		}
228 	}
229 	free_alloca(var_orig, use_heap);
230 }
231 
SAPI_POST_HANDLER_FUNC(php_std_post_handler)232 SAPI_API SAPI_POST_HANDLER_FUNC(php_std_post_handler)
233 {
234 	char *var, *val, *e, *s, *p;
235 	zval *array_ptr = (zval *) arg;
236 	long count = 0;
237 
238 	if (SG(request_info).post_data == NULL) {
239 		return;
240 	}
241 
242 	s = SG(request_info).post_data;
243 	e = s + SG(request_info).post_data_length;
244 
245 	while (s < e && (p = memchr(s, '&', (e - s)))) {
246 last_value:
247 		if ((val = memchr(s, '=', (p - s)))) { /* have a value */
248 			unsigned int val_len, new_val_len;
249 
250 			if (++count > PG(max_input_vars)) {
251 				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Input variables exceeded %ld. To increase the limit change max_input_vars in php.ini.", PG(max_input_vars));
252 				return;
253 			}
254 			var = s;
255 
256 			php_url_decode(var, (val - s));
257 			val++;
258 			val_len = php_url_decode(val, (p - val));
259 			val = estrndup(val, val_len);
260 			if (sapi_module.input_filter(PARSE_POST, var, &val, val_len, &new_val_len TSRMLS_CC)) {
261 				php_register_variable_safe(var, val, new_val_len, array_ptr TSRMLS_CC);
262 			}
263 			efree(val);
264 		}
265 		s = p + 1;
266 	}
267 	if (s < e) {
268 		p = e;
269 		goto last_value;
270 	}
271 }
272 
SAPI_INPUT_FILTER_FUNC(php_default_input_filter)273 SAPI_API SAPI_INPUT_FILTER_FUNC(php_default_input_filter)
274 {
275 	/* TODO: check .ini setting here and apply user-defined input filter */
276 	if(new_val_len) *new_val_len = val_len;
277 	return 1;
278 }
279 
SAPI_TREAT_DATA_FUNC(php_default_treat_data)280 SAPI_API SAPI_TREAT_DATA_FUNC(php_default_treat_data)
281 {
282 	char *res = NULL, *var, *val, *separator = NULL;
283 	const char *c_var;
284 	zval *array_ptr;
285 	int free_buffer = 0;
286 	char *strtok_buf = NULL;
287 	long count = 0;
288 
289 	switch (arg) {
290 		case PARSE_POST:
291 		case PARSE_GET:
292 		case PARSE_COOKIE:
293 			ALLOC_ZVAL(array_ptr);
294 			array_init(array_ptr);
295 			INIT_PZVAL(array_ptr);
296 			switch (arg) {
297 				case PARSE_POST:
298 					if (PG(http_globals)[TRACK_VARS_POST]) {
299 						zval_ptr_dtor(&PG(http_globals)[TRACK_VARS_POST]);
300 					}
301 					PG(http_globals)[TRACK_VARS_POST] = array_ptr;
302 					break;
303 				case PARSE_GET:
304 					if (PG(http_globals)[TRACK_VARS_GET]) {
305 						zval_ptr_dtor(&PG(http_globals)[TRACK_VARS_GET]);
306 					}
307 					PG(http_globals)[TRACK_VARS_GET] = array_ptr;
308 					break;
309 				case PARSE_COOKIE:
310 					if (PG(http_globals)[TRACK_VARS_COOKIE]) {
311 						zval_ptr_dtor(&PG(http_globals)[TRACK_VARS_COOKIE]);
312 					}
313 					PG(http_globals)[TRACK_VARS_COOKIE] = array_ptr;
314 					break;
315 			}
316 			break;
317 		default:
318 			array_ptr = destArray;
319 			break;
320 	}
321 
322 	if (arg == PARSE_POST) {
323 		sapi_handle_post(array_ptr TSRMLS_CC);
324 		return;
325 	}
326 
327 	if (arg == PARSE_GET) {		/* GET data */
328 		c_var = SG(request_info).query_string;
329 		if (c_var && *c_var) {
330 			res = (char *) estrdup(c_var);
331 			free_buffer = 1;
332 		} else {
333 			free_buffer = 0;
334 		}
335 	} else if (arg == PARSE_COOKIE) {		/* Cookie data */
336 		c_var = SG(request_info).cookie_data;
337 		if (c_var && *c_var) {
338 			res = (char *) estrdup(c_var);
339 			free_buffer = 1;
340 		} else {
341 			free_buffer = 0;
342 		}
343 	} else if (arg == PARSE_STRING) {		/* String data */
344 		res = str;
345 		free_buffer = 1;
346 	}
347 
348 	if (!res) {
349 		return;
350 	}
351 
352 	switch (arg) {
353 		case PARSE_GET:
354 		case PARSE_STRING:
355 			separator = (char *) estrdup(PG(arg_separator).input);
356 			break;
357 		case PARSE_COOKIE:
358 			separator = ";\0";
359 			break;
360 	}
361 
362 	var = php_strtok_r(res, separator, &strtok_buf);
363 
364 	while (var) {
365 		val = strchr(var, '=');
366 
367 		if (arg == PARSE_COOKIE) {
368 			/* Remove leading spaces from cookie names, needed for multi-cookie header where ; can be followed by a space */
369 			while (isspace(*var)) {
370 				var++;
371 			}
372 			if (var == val || *var == '\0') {
373 				goto next_cookie;
374 			}
375 		}
376 
377 		if (++count > PG(max_input_vars)) {
378 			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Input variables exceeded %ld. To increase the limit change max_input_vars in php.ini.", PG(max_input_vars));
379 			break;
380 		}
381 
382 		if (val) { /* have a value */
383 			int val_len;
384 			unsigned int new_val_len;
385 
386 			*val++ = '\0';
387 			php_url_decode(var, strlen(var));
388 			val_len = php_url_decode(val, strlen(val));
389 			val = estrndup(val, val_len);
390 			if (sapi_module.input_filter(arg, var, &val, val_len, &new_val_len TSRMLS_CC)) {
391 				php_register_variable_safe(var, val, new_val_len, array_ptr TSRMLS_CC);
392 			}
393 			efree(val);
394 		} else {
395 			int val_len;
396 			unsigned int new_val_len;
397 
398 			php_url_decode(var, strlen(var));
399 			val_len = 0;
400 			val = estrndup("", val_len);
401 			if (sapi_module.input_filter(arg, var, &val, val_len, &new_val_len TSRMLS_CC)) {
402 				php_register_variable_safe(var, val, new_val_len, array_ptr TSRMLS_CC);
403 			}
404 			efree(val);
405 		}
406 next_cookie:
407 		var = php_strtok_r(NULL, separator, &strtok_buf);
408 	}
409 
410 	if (arg != PARSE_COOKIE) {
411 		efree(separator);
412 	}
413 
414 	if (free_buffer) {
415 		efree(res);
416 	}
417 }
418 
_php_import_environment_variables(zval * array_ptr TSRMLS_DC)419 void _php_import_environment_variables(zval *array_ptr TSRMLS_DC)
420 {
421 	char buf[128];
422 	char **env, *p, *t = buf;
423 	size_t alloc_size = sizeof(buf);
424 	unsigned long nlen; /* ptrdiff_t is not portable */
425 
426 	for (env = environ; env != NULL && *env != NULL; env++) {
427 		p = strchr(*env, '=');
428 		if (!p) {				/* malformed entry? */
429 			continue;
430 		}
431 		nlen = p - *env;
432 		if (nlen >= alloc_size) {
433 			alloc_size = nlen + 64;
434 			t = (t == buf ? emalloc(alloc_size): erealloc(t, alloc_size));
435 		}
436 		memcpy(t, *env, nlen);
437 		t[nlen] = '\0';
438 		php_register_variable(t, p + 1, array_ptr TSRMLS_CC);
439 	}
440 	if (t != buf && t != NULL) {
441 		efree(t);
442 	}
443 }
444 
php_std_auto_global_callback(char * name,uint name_len TSRMLS_DC)445 zend_bool php_std_auto_global_callback(char *name, uint name_len TSRMLS_DC)
446 {
447 	zend_printf("%s\n", name);
448 	return 0; /* don't rearm */
449 }
450 
451 /* {{{ php_build_argv
452  */
php_build_argv(char * s,zval * track_vars_array TSRMLS_DC)453 static void php_build_argv(char *s, zval *track_vars_array TSRMLS_DC)
454 {
455 	zval *arr, *argc, *tmp;
456 	int count = 0;
457 	char *ss, *space;
458 
459 	if (!(SG(request_info).argc || track_vars_array)) {
460 		return;
461 	}
462 
463 	ALLOC_INIT_ZVAL(arr);
464 	array_init(arr);
465 
466 	/* Prepare argv */
467 	if (SG(request_info).argc) { /* are we in cli sapi? */
468 		int i;
469 		for (i = 0; i < SG(request_info).argc; i++) {
470 			ALLOC_ZVAL(tmp);
471 			Z_TYPE_P(tmp) = IS_STRING;
472 			Z_STRLEN_P(tmp) = strlen(SG(request_info).argv[i]);
473 			Z_STRVAL_P(tmp) = estrndup(SG(request_info).argv[i], Z_STRLEN_P(tmp));
474 			INIT_PZVAL(tmp);
475 			if (zend_hash_next_index_insert(Z_ARRVAL_P(arr), &tmp, sizeof(zval *), NULL) == FAILURE) {
476 				if (Z_TYPE_P(tmp) == IS_STRING) {
477 					efree(Z_STRVAL_P(tmp));
478 				}
479 			}
480 		}
481 	} else 	if (s && *s) {
482 		ss = s;
483 		while (ss) {
484 			space = strchr(ss, '+');
485 			if (space) {
486 				*space = '\0';
487 			}
488 			/* auto-type */
489 			ALLOC_ZVAL(tmp);
490 			Z_TYPE_P(tmp) = IS_STRING;
491 			Z_STRLEN_P(tmp) = strlen(ss);
492 			Z_STRVAL_P(tmp) = estrndup(ss, Z_STRLEN_P(tmp));
493 			INIT_PZVAL(tmp);
494 			count++;
495 			if (zend_hash_next_index_insert(Z_ARRVAL_P(arr), &tmp, sizeof(zval *), NULL) == FAILURE) {
496 				if (Z_TYPE_P(tmp) == IS_STRING) {
497 					efree(Z_STRVAL_P(tmp));
498 				}
499 			}
500 			if (space) {
501 				*space = '+';
502 				ss = space + 1;
503 			} else {
504 				ss = space;
505 			}
506 		}
507 	}
508 
509 	/* prepare argc */
510 	ALLOC_INIT_ZVAL(argc);
511 	if (SG(request_info).argc) {
512 		Z_LVAL_P(argc) = SG(request_info).argc;
513 	} else {
514 		Z_LVAL_P(argc) = count;
515 	}
516 	Z_TYPE_P(argc) = IS_LONG;
517 
518 	if (SG(request_info).argc) {
519 		Z_ADDREF_P(arr);
520 		Z_ADDREF_P(argc);
521 		zend_hash_update(&EG(symbol_table), "argv", sizeof("argv"), &arr, sizeof(zval *), NULL);
522 		zend_hash_update(&EG(symbol_table), "argc", sizeof("argc"), &argc, sizeof(zval *), NULL);
523 	}
524 	if (track_vars_array) {
525 		Z_ADDREF_P(arr);
526 		Z_ADDREF_P(argc);
527 		zend_hash_update(Z_ARRVAL_P(track_vars_array), "argv", sizeof("argv"), &arr, sizeof(zval *), NULL);
528 		zend_hash_update(Z_ARRVAL_P(track_vars_array), "argc", sizeof("argc"), &argc, sizeof(zval *), NULL);
529 	}
530 	zval_ptr_dtor(&arr);
531 	zval_ptr_dtor(&argc);
532 }
533 /* }}} */
534 
535 /* {{{ php_handle_special_queries
536  */
php_handle_special_queries(TSRMLS_D)537 PHPAPI int php_handle_special_queries(TSRMLS_D)
538 {
539 	if (PG(expose_php) && SG(request_info).query_string && SG(request_info).query_string[0] == '=') {
540 		if (php_info_logos(SG(request_info).query_string + 1 TSRMLS_CC)) {
541 			return 1;
542 		} else if (!strcmp(SG(request_info).query_string + 1, PHP_CREDITS_GUID)) {
543 			php_print_credits(PHP_CREDITS_ALL TSRMLS_CC);
544 			return 1;
545 		}
546 	}
547 	return 0;
548 }
549 /* }}} */
550 
551 /* {{{ php_register_server_variables
552  */
php_register_server_variables(TSRMLS_D)553 static inline void php_register_server_variables(TSRMLS_D)
554 {
555 	zval *array_ptr = NULL;
556 
557 	ALLOC_ZVAL(array_ptr);
558 	array_init(array_ptr);
559 	INIT_PZVAL(array_ptr);
560 	if (PG(http_globals)[TRACK_VARS_SERVER]) {
561 		zval_ptr_dtor(&PG(http_globals)[TRACK_VARS_SERVER]);
562 	}
563 	PG(http_globals)[TRACK_VARS_SERVER] = array_ptr;
564 
565 	/* Server variables */
566 	if (sapi_module.register_server_variables) {
567 		sapi_module.register_server_variables(array_ptr TSRMLS_CC);
568 	}
569 
570 	/* PHP Authentication support */
571 	if (SG(request_info).auth_user) {
572 		php_register_variable("PHP_AUTH_USER", SG(request_info).auth_user, array_ptr TSRMLS_CC);
573 	}
574 	if (SG(request_info).auth_password) {
575 		php_register_variable("PHP_AUTH_PW", SG(request_info).auth_password, array_ptr TSRMLS_CC);
576 	}
577 	if (SG(request_info).auth_digest) {
578 		php_register_variable("PHP_AUTH_DIGEST", SG(request_info).auth_digest, array_ptr TSRMLS_CC);
579 	}
580 	/* store request init time */
581 	{
582 		zval request_time_float, request_time_long;
583 		Z_TYPE(request_time_float) = IS_DOUBLE;
584 		Z_DVAL(request_time_float) = sapi_get_request_time(TSRMLS_C);
585 		php_register_variable_ex("REQUEST_TIME_FLOAT", &request_time_float, array_ptr TSRMLS_CC);
586 		Z_TYPE(request_time_long) = IS_LONG;
587 		Z_LVAL(request_time_long) = zend_dval_to_lval(Z_DVAL(request_time_float));
588 		php_register_variable_ex("REQUEST_TIME", &request_time_long, array_ptr TSRMLS_CC);
589 	}
590 
591 }
592 /* }}} */
593 
594 /* {{{ php_autoglobal_merge
595  */
php_autoglobal_merge(HashTable * dest,HashTable * src TSRMLS_DC)596 static void php_autoglobal_merge(HashTable *dest, HashTable *src TSRMLS_DC)
597 {
598 	zval **src_entry, **dest_entry;
599 	char *string_key;
600 	uint string_key_len;
601 	ulong num_key;
602 	HashPosition pos;
603 	int key_type;
604 	int globals_check = (dest == (&EG(symbol_table)));
605 
606 	zend_hash_internal_pointer_reset_ex(src, &pos);
607 	while (zend_hash_get_current_data_ex(src, (void **)&src_entry, &pos) == SUCCESS) {
608 		key_type = zend_hash_get_current_key_ex(src, &string_key, &string_key_len, &num_key, 0, &pos);
609 		if (Z_TYPE_PP(src_entry) != IS_ARRAY
610 			|| (key_type == HASH_KEY_IS_STRING && zend_hash_find(dest, string_key, string_key_len, (void **) &dest_entry) != SUCCESS)
611 			|| (key_type == HASH_KEY_IS_LONG && zend_hash_index_find(dest, num_key, (void **)&dest_entry) != SUCCESS)
612 			|| Z_TYPE_PP(dest_entry) != IS_ARRAY
613 			) {
614 			Z_ADDREF_PP(src_entry);
615 			if (key_type == HASH_KEY_IS_STRING) {
616 				if (!globals_check || string_key_len != sizeof("GLOBALS") || memcmp(string_key, "GLOBALS", sizeof("GLOBALS") - 1)) {
617 					zend_hash_update(dest, string_key, string_key_len, src_entry, sizeof(zval *), NULL);
618 				} else {
619 					Z_DELREF_PP(src_entry);
620 				}
621 			} else {
622 				zend_hash_index_update(dest, num_key, src_entry, sizeof(zval *), NULL);
623 			}
624 		} else {
625 			SEPARATE_ZVAL(dest_entry);
626 			php_autoglobal_merge(Z_ARRVAL_PP(dest_entry), Z_ARRVAL_PP(src_entry) TSRMLS_CC);
627 		}
628 		zend_hash_move_forward_ex(src, &pos);
629 	}
630 }
631 /* }}} */
632 
633 static zend_bool php_auto_globals_create_server(const char *name, uint name_len TSRMLS_DC);
634 static zend_bool php_auto_globals_create_env(const char *name, uint name_len TSRMLS_DC);
635 static zend_bool php_auto_globals_create_request(const char *name, uint name_len TSRMLS_DC);
636 
637 /* {{{ php_hash_environment
638  */
php_hash_environment(TSRMLS_D)639 PHPAPI int php_hash_environment(TSRMLS_D)
640 {
641 	memset(PG(http_globals), 0, sizeof(PG(http_globals)));
642 	zend_activate_auto_globals(TSRMLS_C);
643 	if (PG(register_argc_argv)) {
644 		php_build_argv(SG(request_info).query_string, PG(http_globals)[TRACK_VARS_SERVER] TSRMLS_CC);
645 	}
646 	return SUCCESS;
647 }
648 /* }}} */
649 
php_auto_globals_create_get(const char * name,uint name_len TSRMLS_DC)650 static zend_bool php_auto_globals_create_get(const char *name, uint name_len TSRMLS_DC)
651 {
652 	zval *vars;
653 
654 	if (PG(variables_order) && (strchr(PG(variables_order),'G') || strchr(PG(variables_order),'g'))) {
655 		sapi_module.treat_data(PARSE_GET, NULL, NULL TSRMLS_CC);
656 		vars = PG(http_globals)[TRACK_VARS_GET];
657 	} else {
658 		ALLOC_ZVAL(vars);
659 		array_init(vars);
660 		INIT_PZVAL(vars);
661 		if (PG(http_globals)[TRACK_VARS_GET]) {
662 			zval_ptr_dtor(&PG(http_globals)[TRACK_VARS_GET]);
663 		}
664 		PG(http_globals)[TRACK_VARS_GET] = vars;
665 	}
666 
667 	zend_hash_update(&EG(symbol_table), name, name_len + 1, &vars, sizeof(zval *), NULL);
668 	Z_ADDREF_P(vars);
669 
670 	return 0; /* don't rearm */
671 }
672 
php_auto_globals_create_post(const char * name,uint name_len TSRMLS_DC)673 static zend_bool php_auto_globals_create_post(const char *name, uint name_len TSRMLS_DC)
674 {
675 	zval *vars;
676 
677 	if (PG(variables_order) &&
678 			(strchr(PG(variables_order),'P') || strchr(PG(variables_order),'p')) &&
679 		!SG(headers_sent) &&
680 		SG(request_info).request_method &&
681 		!strcasecmp(SG(request_info).request_method, "POST")) {
682 		sapi_module.treat_data(PARSE_POST, NULL, NULL TSRMLS_CC);
683 		vars = PG(http_globals)[TRACK_VARS_POST];
684 	} else {
685 		ALLOC_ZVAL(vars);
686 		array_init(vars);
687 		INIT_PZVAL(vars);
688 		if (PG(http_globals)[TRACK_VARS_POST]) {
689 			zval_ptr_dtor(&PG(http_globals)[TRACK_VARS_POST]);
690 		}
691 		PG(http_globals)[TRACK_VARS_POST] = vars;
692 	}
693 
694 	zend_hash_update(&EG(symbol_table), name, name_len + 1, &vars, sizeof(zval *), NULL);
695 	Z_ADDREF_P(vars);
696 
697 	return 0; /* don't rearm */
698 }
699 
php_auto_globals_create_cookie(const char * name,uint name_len TSRMLS_DC)700 static zend_bool php_auto_globals_create_cookie(const char *name, uint name_len TSRMLS_DC)
701 {
702 	zval *vars;
703 
704 	if (PG(variables_order) && (strchr(PG(variables_order),'C') || strchr(PG(variables_order),'c'))) {
705 		sapi_module.treat_data(PARSE_COOKIE, NULL, NULL TSRMLS_CC);
706 		vars = PG(http_globals)[TRACK_VARS_COOKIE];
707 	} else {
708 		ALLOC_ZVAL(vars);
709 		array_init(vars);
710 		INIT_PZVAL(vars);
711 		if (PG(http_globals)[TRACK_VARS_COOKIE]) {
712 			zval_ptr_dtor(&PG(http_globals)[TRACK_VARS_COOKIE]);
713 		}
714 		PG(http_globals)[TRACK_VARS_COOKIE] = vars;
715 	}
716 
717 	zend_hash_update(&EG(symbol_table), name, name_len + 1, &vars, sizeof(zval *), NULL);
718 	Z_ADDREF_P(vars);
719 
720 	return 0; /* don't rearm */
721 }
722 
php_auto_globals_create_files(const char * name,uint name_len TSRMLS_DC)723 static zend_bool php_auto_globals_create_files(const char *name, uint name_len TSRMLS_DC)
724 {
725 	zval *vars;
726 
727 	if (PG(http_globals)[TRACK_VARS_FILES]) {
728 		vars = PG(http_globals)[TRACK_VARS_FILES];
729 	} else {
730 		ALLOC_ZVAL(vars);
731 		array_init(vars);
732 		INIT_PZVAL(vars);
733 		PG(http_globals)[TRACK_VARS_FILES] = vars;
734 	}
735 
736 	zend_hash_update(&EG(symbol_table), name, name_len + 1, &vars, sizeof(zval *), NULL);
737 	Z_ADDREF_P(vars);
738 
739 	return 0; /* don't rearm */
740 }
741 
php_auto_globals_create_server(const char * name,uint name_len TSRMLS_DC)742 static zend_bool php_auto_globals_create_server(const char *name, uint name_len TSRMLS_DC)
743 {
744 	if (PG(variables_order) && (strchr(PG(variables_order),'S') || strchr(PG(variables_order),'s'))) {
745 		php_register_server_variables(TSRMLS_C);
746 
747 		if (PG(register_argc_argv)) {
748 			if (SG(request_info).argc) {
749 				zval **argc, **argv;
750 
751 				if (zend_hash_find(&EG(symbol_table), "argc", sizeof("argc"), (void**)&argc) == SUCCESS &&
752 					zend_hash_find(&EG(symbol_table), "argv", sizeof("argv"), (void**)&argv) == SUCCESS) {
753 					Z_ADDREF_PP(argc);
754 					Z_ADDREF_PP(argv);
755 					zend_hash_update(Z_ARRVAL_P(PG(http_globals)[TRACK_VARS_SERVER]), "argv", sizeof("argv"), argv, sizeof(zval *), NULL);
756 					zend_hash_update(Z_ARRVAL_P(PG(http_globals)[TRACK_VARS_SERVER]), "argc", sizeof("argc"), argc, sizeof(zval *), NULL);
757 				}
758 			} else {
759 				php_build_argv(SG(request_info).query_string, PG(http_globals)[TRACK_VARS_SERVER] TSRMLS_CC);
760 			}
761 		}
762 
763 	} else {
764 		zval *server_vars=NULL;
765 		ALLOC_ZVAL(server_vars);
766 		array_init(server_vars);
767 		INIT_PZVAL(server_vars);
768 		if (PG(http_globals)[TRACK_VARS_SERVER]) {
769 			zval_ptr_dtor(&PG(http_globals)[TRACK_VARS_SERVER]);
770 		}
771 		PG(http_globals)[TRACK_VARS_SERVER] = server_vars;
772 	}
773 
774 	zend_hash_update(&EG(symbol_table), name, name_len + 1, &PG(http_globals)[TRACK_VARS_SERVER], sizeof(zval *), NULL);
775 	Z_ADDREF_P(PG(http_globals)[TRACK_VARS_SERVER]);
776 
777 	return 0; /* don't rearm */
778 }
779 
php_auto_globals_create_env(const char * name,uint name_len TSRMLS_DC)780 static zend_bool php_auto_globals_create_env(const char *name, uint name_len TSRMLS_DC)
781 {
782 	zval *env_vars = NULL;
783 	ALLOC_ZVAL(env_vars);
784 	array_init(env_vars);
785 	INIT_PZVAL(env_vars);
786 	if (PG(http_globals)[TRACK_VARS_ENV]) {
787 		zval_ptr_dtor(&PG(http_globals)[TRACK_VARS_ENV]);
788 	}
789 	PG(http_globals)[TRACK_VARS_ENV] = env_vars;
790 
791 	if (PG(variables_order) && (strchr(PG(variables_order),'E') || strchr(PG(variables_order),'e'))) {
792 		php_import_environment_variables(PG(http_globals)[TRACK_VARS_ENV] TSRMLS_CC);
793 	}
794 
795 	zend_hash_update(&EG(symbol_table), name, name_len + 1, &PG(http_globals)[TRACK_VARS_ENV], sizeof(zval *), NULL);
796 	Z_ADDREF_P(PG(http_globals)[TRACK_VARS_ENV]);
797 
798 	return 0; /* don't rearm */
799 }
800 
php_auto_globals_create_request(const char * name,uint name_len TSRMLS_DC)801 static zend_bool php_auto_globals_create_request(const char *name, uint name_len TSRMLS_DC)
802 {
803 	zval *form_variables;
804 	unsigned char _gpc_flags[3] = {0, 0, 0};
805 	char *p;
806 
807 	ALLOC_ZVAL(form_variables);
808 	array_init(form_variables);
809 	INIT_PZVAL(form_variables);
810 
811 	if (PG(request_order) != NULL) {
812 		p = PG(request_order);
813 	} else {
814 		p = PG(variables_order);
815 	}
816 
817 	for (; p && *p; p++) {
818 		switch (*p) {
819 			case 'g':
820 			case 'G':
821 				if (!_gpc_flags[0]) {
822 					php_autoglobal_merge(Z_ARRVAL_P(form_variables), Z_ARRVAL_P(PG(http_globals)[TRACK_VARS_GET]) TSRMLS_CC);
823 					_gpc_flags[0] = 1;
824 				}
825 				break;
826 			case 'p':
827 			case 'P':
828 				if (!_gpc_flags[1]) {
829 					php_autoglobal_merge(Z_ARRVAL_P(form_variables), Z_ARRVAL_P(PG(http_globals)[TRACK_VARS_POST]) TSRMLS_CC);
830 					_gpc_flags[1] = 1;
831 				}
832 				break;
833 			case 'c':
834 			case 'C':
835 				if (!_gpc_flags[2]) {
836 					php_autoglobal_merge(Z_ARRVAL_P(form_variables), Z_ARRVAL_P(PG(http_globals)[TRACK_VARS_COOKIE]) TSRMLS_CC);
837 					_gpc_flags[2] = 1;
838 				}
839 				break;
840 		}
841 	}
842 
843 	zend_hash_update(&EG(symbol_table), name, name_len + 1, &form_variables, sizeof(zval *), NULL);
844 	return 0;
845 }
846 
php_startup_auto_globals(TSRMLS_D)847 void php_startup_auto_globals(TSRMLS_D)
848 {
849 	zend_register_auto_global(ZEND_STRL("_GET"), 0, php_auto_globals_create_get TSRMLS_CC);
850 	zend_register_auto_global(ZEND_STRL("_POST"), 0, php_auto_globals_create_post TSRMLS_CC);
851 	zend_register_auto_global(ZEND_STRL("_COOKIE"), 0, php_auto_globals_create_cookie TSRMLS_CC);
852 	zend_register_auto_global(ZEND_STRL("_SERVER"), PG(auto_globals_jit), php_auto_globals_create_server TSRMLS_CC);
853 	zend_register_auto_global(ZEND_STRL("_ENV"), PG(auto_globals_jit), php_auto_globals_create_env TSRMLS_CC);
854 	zend_register_auto_global(ZEND_STRL("_REQUEST"), PG(auto_globals_jit), php_auto_globals_create_request TSRMLS_CC);
855 	zend_register_auto_global(ZEND_STRL("_FILES"), 0, php_auto_globals_create_files TSRMLS_CC);
856 }
857 
858 /*
859  * Local variables:
860  * tab-width: 4
861  * c-basic-offset: 4
862  * End:
863  * vim600: sw=4 ts=4 fdm=marker
864  * vim<600: sw=4 ts=4
865  */
866