1 /*
2    +----------------------------------------------------------------------+
3    | PHP Version 7                                                        |
4    +----------------------------------------------------------------------+
5    | Copyright (c) 1997-2018 The PHP Group                                |
6    +----------------------------------------------------------------------+
7    | This source file is subject to version 3.01 of the PHP license,      |
8    | that is bundled with this package in the file LICENSE, and is        |
9    | available through the world-wide-web at the following url:           |
10    | http://www.php.net/license/3_01.txt                                  |
11    | If you did not receive a copy of the PHP license and are unable to   |
12    | obtain it through the world-wide-web, please send a note to          |
13    | license@php.net so we can mail you a copy immediately.               |
14    +----------------------------------------------------------------------+
15    | Authors: Sascha Schumann <sascha@schumann.cx>                        |
16    |          Parts based on Apache 1.3 SAPI module by                    |
17    |          Rasmus Lerdorf and Zeev Suraski                             |
18    +----------------------------------------------------------------------+
19  */
20 
21 /* $Id$ */
22 
23 #define ZEND_INCLUDE_FULL_WINDOWS_HEADERS
24 
25 #include "php.h"
26 #include "php_main.h"
27 #include "php_ini.h"
28 #include "php_variables.h"
29 #include "SAPI.h"
30 
31 #include <fcntl.h>
32 
33 #include "zend_smart_str.h"
34 #include "ext/standard/php_standard.h"
35 
36 #include "apr_strings.h"
37 #include "ap_config.h"
38 #include "util_filter.h"
39 #include "httpd.h"
40 #include "http_config.h"
41 #include "http_request.h"
42 #include "http_core.h"
43 #include "http_protocol.h"
44 #include "http_log.h"
45 #include "http_main.h"
46 #include "util_script.h"
47 #include "http_core.h"
48 #include "ap_mpm.h"
49 
50 #include "php_apache.h"
51 
52 /* UnixWare define shutdown to _shutdown, which causes problems later
53  * on when using a structure member named shutdown. Since this source
54  * file does not use the system call shutdown, it is safe to #undef it.
55  */
56 #undef shutdown
57 
58 #define PHP_MAGIC_TYPE "application/x-httpd-php"
59 #define PHP_SOURCE_MAGIC_TYPE "application/x-httpd-php-source"
60 #define PHP_SCRIPT "php7-script"
61 
62 /* A way to specify the location of the php.ini dir in an apache directive */
63 char *apache2_php_ini_path_override = NULL;
64 #if defined(PHP_WIN32) && defined(ZTS)
ZEND_TSRMLS_CACHE_DEFINE()65 ZEND_TSRMLS_CACHE_DEFINE()
66 #endif
67 
68 static size_t
69 php_apache_sapi_ub_write(const char *str, size_t str_length)
70 {
71 	request_rec *r;
72 	php_struct *ctx;
73 
74 	ctx = SG(server_context);
75 	r = ctx->r;
76 
77 	if (ap_rwrite(str, str_length, r) < 0) {
78 		php_handle_aborted_connection();
79 	}
80 
81 	return str_length; /* we always consume all the data passed to us. */
82 }
83 
84 static int
php_apache_sapi_header_handler(sapi_header_struct * sapi_header,sapi_header_op_enum op,sapi_headers_struct * sapi_headers)85 php_apache_sapi_header_handler(sapi_header_struct *sapi_header, sapi_header_op_enum op, sapi_headers_struct *sapi_headers)
86 {
87 	php_struct *ctx;
88 	char *val, *ptr;
89 
90 	ctx = SG(server_context);
91 
92 	switch (op) {
93 		case SAPI_HEADER_DELETE:
94 			apr_table_unset(ctx->r->headers_out, sapi_header->header);
95 			return 0;
96 
97 		case SAPI_HEADER_DELETE_ALL:
98 			apr_table_clear(ctx->r->headers_out);
99 			return 0;
100 
101 		case SAPI_HEADER_ADD:
102 		case SAPI_HEADER_REPLACE:
103 			val = strchr(sapi_header->header, ':');
104 
105 			if (!val) {
106 				return 0;
107 			}
108 			ptr = val;
109 
110 			*val = '\0';
111 
112 			do {
113 				val++;
114 			} while (*val == ' ');
115 
116 			if (!strcasecmp(sapi_header->header, "content-type")) {
117 				if (ctx->content_type) {
118 					efree(ctx->content_type);
119 				}
120 				ctx->content_type = estrdup(val);
121 			} else if (!strcasecmp(sapi_header->header, "content-length")) {
122 				apr_off_t clen = 0;
123 
124 				if (APR_SUCCESS != apr_strtoff(&clen, val, (char **) NULL, 10)) {
125 					/* We'll fall back to strtol, since that's what we used to
126 					 * do anyway. */
127 					clen = (apr_off_t) strtol(val, (char **) NULL, 10);
128 				}
129 
130 				ap_set_content_length(ctx->r, clen);
131 			} else if (op == SAPI_HEADER_REPLACE) {
132 				apr_table_set(ctx->r->headers_out, sapi_header->header, val);
133 			} else {
134 				apr_table_add(ctx->r->headers_out, sapi_header->header, val);
135 			}
136 
137 			*ptr = ':';
138 
139 			return SAPI_HEADER_ADD;
140 
141 		default:
142 			return 0;
143 	}
144 }
145 
146 static int
php_apache_sapi_send_headers(sapi_headers_struct * sapi_headers)147 php_apache_sapi_send_headers(sapi_headers_struct *sapi_headers)
148 {
149 	php_struct *ctx = SG(server_context);
150 	const char *sline = SG(sapi_headers).http_status_line;
151 
152 	ctx->r->status = SG(sapi_headers).http_response_code;
153 
154 	/* httpd requires that r->status_line is set to the first digit of
155 	 * the status-code: */
156 	if (sline && strlen(sline) > 12 && strncmp(sline, "HTTP/1.", 7) == 0 && sline[8] == ' ') {
157 		ctx->r->status_line = apr_pstrdup(ctx->r->pool, sline + 9);
158 		ctx->r->proto_num = 1000 + (sline[7]-'0');
159 		if ((sline[7]-'0') == 0) {
160 			apr_table_set(ctx->r->subprocess_env, "force-response-1.0", "true");
161 		}
162 	}
163 
164 	/*	call ap_set_content_type only once, else each time we call it,
165 		configured output filters for that content type will be added */
166 	if (!ctx->content_type) {
167 		ctx->content_type = sapi_get_default_content_type();
168 	}
169 	ap_set_content_type(ctx->r, apr_pstrdup(ctx->r->pool, ctx->content_type));
170 	efree(ctx->content_type);
171 	ctx->content_type = NULL;
172 
173 	return SAPI_HEADER_SENT_SUCCESSFULLY;
174 }
175 
176 static apr_size_t
php_apache_sapi_read_post(char * buf,size_t count_bytes)177 php_apache_sapi_read_post(char *buf, size_t count_bytes)
178 {
179 	apr_size_t len, tlen=0;
180 	php_struct *ctx = SG(server_context);
181 	request_rec *r;
182 	apr_bucket_brigade *brigade;
183 
184 	r = ctx->r;
185 	brigade = ctx->brigade;
186 	len = count_bytes;
187 
188 	/*
189 	 * This loop is needed because ap_get_brigade() can return us partial data
190 	 * which would cause premature termination of request read. Therefor we
191 	 * need to make sure that if data is available we fill the buffer completely.
192 	 */
193 
194 	while (ap_get_brigade(r->input_filters, brigade, AP_MODE_READBYTES, APR_BLOCK_READ, len) == APR_SUCCESS) {
195 		apr_brigade_flatten(brigade, buf, &len);
196 		apr_brigade_cleanup(brigade);
197 		tlen += len;
198 		if (tlen == count_bytes || !len) {
199 			break;
200 		}
201 		buf += len;
202 		len = count_bytes - tlen;
203 	}
204 
205 	return tlen;
206 }
207 
208 static zend_stat_t*
php_apache_sapi_get_stat(void)209 php_apache_sapi_get_stat(void)
210 {
211 	php_struct *ctx = SG(server_context);
212 
213 #ifdef PHP_WIN32
214 	ctx->finfo.st_uid = 0;
215 	ctx->finfo.st_gid = 0;
216 #else
217 	ctx->finfo.st_uid = ctx->r->finfo.user;
218 	ctx->finfo.st_gid = ctx->r->finfo.group;
219 #endif
220 	ctx->finfo.st_dev = ctx->r->finfo.device;
221 	ctx->finfo.st_ino = ctx->r->finfo.inode;
222 	ctx->finfo.st_atime = apr_time_sec(ctx->r->finfo.atime);
223 	ctx->finfo.st_mtime = apr_time_sec(ctx->r->finfo.mtime);
224 	ctx->finfo.st_ctime = apr_time_sec(ctx->r->finfo.ctime);
225 	ctx->finfo.st_size = ctx->r->finfo.size;
226 	ctx->finfo.st_nlink = ctx->r->finfo.nlink;
227 
228 	return &ctx->finfo;
229 }
230 
231 static char *
php_apache_sapi_read_cookies(void)232 php_apache_sapi_read_cookies(void)
233 {
234 	php_struct *ctx = SG(server_context);
235 	const char *http_cookie;
236 
237 	http_cookie = apr_table_get(ctx->r->headers_in, "cookie");
238 
239 	/* The SAPI interface should use 'const char *' */
240 	return (char *) http_cookie;
241 }
242 
243 static char *
php_apache_sapi_getenv(char * name,size_t name_len)244 php_apache_sapi_getenv(char *name, size_t name_len)
245 {
246 	php_struct *ctx = SG(server_context);
247 	const char *env_var;
248 
249 	if (ctx == NULL) {
250 		return NULL;
251 	}
252 
253 	env_var = apr_table_get(ctx->r->subprocess_env, name);
254 
255 	return (char *) env_var;
256 }
257 
258 static void
php_apache_sapi_register_variables(zval * track_vars_array)259 php_apache_sapi_register_variables(zval *track_vars_array)
260 {
261 	php_struct *ctx = SG(server_context);
262 	const apr_array_header_t *arr = apr_table_elts(ctx->r->subprocess_env);
263 	char *key, *val;
264 	size_t new_val_len;
265 
266 	APR_ARRAY_FOREACH_OPEN(arr, key, val)
267 		if (!val) {
268 			val = "";
269 		}
270 		if (sapi_module.input_filter(PARSE_SERVER, key, &val, strlen(val), &new_val_len)) {
271 			php_register_variable_safe(key, val, new_val_len, track_vars_array);
272 		}
273 	APR_ARRAY_FOREACH_CLOSE()
274 
275 	if (sapi_module.input_filter(PARSE_SERVER, "PHP_SELF", &ctx->r->uri, strlen(ctx->r->uri), &new_val_len)) {
276 		php_register_variable_safe("PHP_SELF", ctx->r->uri, new_val_len, track_vars_array);
277 	}
278 }
279 
280 static void
php_apache_sapi_flush(void * server_context)281 php_apache_sapi_flush(void *server_context)
282 {
283 	php_struct *ctx;
284 	request_rec *r;
285 
286 	ctx = server_context;
287 
288 	/* If we haven't registered a server_context yet,
289 	 * then don't bother flushing. */
290 	if (!server_context) {
291 		return;
292 	}
293 
294 	r = ctx->r;
295 
296 	sapi_send_headers();
297 
298 	r->status = SG(sapi_headers).http_response_code;
299 	SG(headers_sent) = 1;
300 
301 	if (ap_rflush(r) < 0 || r->connection->aborted) {
302 		php_handle_aborted_connection();
303 	}
304 }
305 
php_apache_sapi_log_message(char * msg,int syslog_type_int)306 static void php_apache_sapi_log_message(char *msg, int syslog_type_int)
307 {
308 	php_struct *ctx;
309 	int aplog_type = APLOG_ERR;
310 
311 	ctx = SG(server_context);
312 
313 	switch (syslog_type_int) {
314 #if LOG_EMERG != LOG_CRIT
315 		case LOG_EMERG:
316 			aplog_type = APLOG_EMERG;
317 			break;
318 #endif
319 #if LOG_ALERT != LOG_CRIT
320 		case LOG_ALERT:
321 			aplog_type = APLOG_ALERT;
322 			break;
323 #endif
324 		case LOG_CRIT:
325 			aplog_type = APLOG_CRIT;
326 			break;
327 		case LOG_ERR:
328 			aplog_type = APLOG_ERR;
329 			break;
330 		case LOG_WARNING:
331 			aplog_type = APLOG_WARNING;
332 			break;
333 		case LOG_NOTICE:
334 			aplog_type = APLOG_NOTICE;
335 			break;
336 #if LOG_INFO != LOG_NOTICE
337 		case LOG_INFO:
338 			aplog_type = APLOG_INFO;
339 			break;
340 #endif
341 #if LOG_NOTICE != LOG_DEBUG
342 		case LOG_DEBUG:
343 			aplog_type = APLOG_DEBUG;
344 			break;
345 #endif
346 	}
347 
348 	if (ctx == NULL) { /* we haven't initialized our ctx yet, oh well */
349 		ap_log_error(APLOG_MARK, APLOG_ERR | APLOG_STARTUP, 0, NULL, "%s", msg);
350 	} else {
351 		ap_log_rerror(APLOG_MARK, aplog_type, 0, ctx->r, "%s", msg);
352 	}
353 }
354 
php_apache_sapi_log_message_ex(char * msg,request_rec * r)355 static void php_apache_sapi_log_message_ex(char *msg, request_rec *r)
356 {
357 	if (r) {
358 		ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, msg, r->filename);
359 	} else {
360 		php_apache_sapi_log_message(msg, -1);
361 	}
362 }
363 
php_apache_sapi_get_request_time(void)364 static double php_apache_sapi_get_request_time(void)
365 {
366 	php_struct *ctx = SG(server_context);
367 	return ((double) apr_time_as_msec(ctx->r->request_time)) / 1000.0;
368 }
369 
370 extern zend_module_entry php_apache_module;
371 
php_apache2_startup(sapi_module_struct * sapi_module)372 static int php_apache2_startup(sapi_module_struct *sapi_module)
373 {
374 	if (php_module_startup(sapi_module, &php_apache_module, 1)==FAILURE) {
375 		return FAILURE;
376 	}
377 	return SUCCESS;
378 }
379 
380 static sapi_module_struct apache2_sapi_module = {
381 	"apache2handler",
382 	"Apache 2.0 Handler",
383 
384 	php_apache2_startup,				/* startup */
385 	php_module_shutdown_wrapper,			/* shutdown */
386 
387 	NULL,						/* activate */
388 	NULL,						/* deactivate */
389 
390 	php_apache_sapi_ub_write,			/* unbuffered write */
391 	php_apache_sapi_flush,				/* flush */
392 	php_apache_sapi_get_stat,			/* get uid */
393 	php_apache_sapi_getenv,				/* getenv */
394 
395 	php_error,					/* error handler */
396 
397 	php_apache_sapi_header_handler,			/* header handler */
398 	php_apache_sapi_send_headers,			/* send headers handler */
399 	NULL,						/* send header handler */
400 
401 	php_apache_sapi_read_post,			/* read POST data */
402 	php_apache_sapi_read_cookies,			/* read Cookies */
403 
404 	php_apache_sapi_register_variables,
405 	php_apache_sapi_log_message,			/* Log message */
406 	php_apache_sapi_get_request_time,		/* Request Time */
407 	NULL,						/* Child Terminate */
408 
409 	STANDARD_SAPI_MODULE_PROPERTIES
410 };
411 
php_apache_server_shutdown(void * tmp)412 static apr_status_t php_apache_server_shutdown(void *tmp)
413 {
414 	apache2_sapi_module.shutdown(&apache2_sapi_module);
415 	sapi_shutdown();
416 #ifdef ZTS
417 	tsrm_shutdown();
418 #endif
419 	return APR_SUCCESS;
420 }
421 
php_apache_child_shutdown(void * tmp)422 static apr_status_t php_apache_child_shutdown(void *tmp)
423 {
424 	apache2_sapi_module.shutdown(&apache2_sapi_module);
425 #if defined(ZTS) && !defined(PHP_WIN32)
426 	tsrm_shutdown();
427 #endif
428 	return APR_SUCCESS;
429 }
430 
php_apache_add_version(apr_pool_t * p)431 static void php_apache_add_version(apr_pool_t *p)
432 {
433 	if (PG(expose_php)) {
434 		ap_add_version_component(p, "PHP/" PHP_VERSION);
435 	}
436 }
437 
php_pre_config(apr_pool_t * pconf,apr_pool_t * plog,apr_pool_t * ptemp)438 static int php_pre_config(apr_pool_t *pconf, apr_pool_t *plog, apr_pool_t *ptemp)
439 {
440 #ifndef ZTS
441 	int threaded_mpm;
442 
443 	ap_mpm_query(AP_MPMQ_IS_THREADED, &threaded_mpm);
444 	if(threaded_mpm) {
445 		ap_log_error(APLOG_MARK, APLOG_CRIT, 0, 0, "Apache is running a threaded MPM, but your PHP Module is not compiled to be threadsafe.  You need to recompile PHP.");
446 		return DONE;
447 	}
448 #endif
449 	/* When this is NULL, apache won't override the hard-coded default
450 	 * php.ini path setting. */
451 	apache2_php_ini_path_override = NULL;
452 	return OK;
453 }
454 
455 static int
php_apache_server_startup(apr_pool_t * pconf,apr_pool_t * plog,apr_pool_t * ptemp,server_rec * s)456 php_apache_server_startup(apr_pool_t *pconf, apr_pool_t *plog, apr_pool_t *ptemp, server_rec *s)
457 {
458 	void *data = NULL;
459 	const char *userdata_key = "apache2hook_post_config";
460 
461 	/* Apache will load, unload and then reload a DSO module. This
462 	 * prevents us from starting PHP until the second load. */
463 	apr_pool_userdata_get(&data, userdata_key, s->process->pool);
464 	if (data == NULL) {
465 		/* We must use set() here and *not* setn(), otherwise the
466 		 * static string pointed to by userdata_key will be mapped
467 		 * to a different location when the DSO is reloaded and the
468 		 * pointers won't match, causing get() to return NULL when
469 		 * we expected it to return non-NULL. */
470 		apr_pool_userdata_set((const void *)1, userdata_key, apr_pool_cleanup_null, s->process->pool);
471 		return OK;
472 	}
473 
474 	/* Set up our overridden path. */
475 	if (apache2_php_ini_path_override) {
476 		apache2_sapi_module.php_ini_path_override = apache2_php_ini_path_override;
477 	}
478 #ifdef ZTS
479 	tsrm_startup(1, 1, 0, NULL);
480 	(void)ts_resource(0);
481 	ZEND_TSRMLS_CACHE_UPDATE();
482 #endif
483 
484 	zend_signal_startup();
485 
486 	sapi_startup(&apache2_sapi_module);
487 	apache2_sapi_module.startup(&apache2_sapi_module);
488 	apr_pool_cleanup_register(pconf, NULL, php_apache_server_shutdown, apr_pool_cleanup_null);
489 	php_apache_add_version(pconf);
490 
491 	return OK;
492 }
493 
php_server_context_cleanup(void * data_)494 static apr_status_t php_server_context_cleanup(void *data_)
495 {
496 	void **data = data_;
497 	*data = NULL;
498 	return APR_SUCCESS;
499 }
500 
php_apache_request_ctor(request_rec * r,php_struct * ctx)501 static int php_apache_request_ctor(request_rec *r, php_struct *ctx)
502 {
503 	char *content_length;
504 	const char *auth;
505 
506 	SG(sapi_headers).http_response_code = !r->status ? HTTP_OK : r->status;
507 	SG(request_info).content_type = apr_table_get(r->headers_in, "Content-Type");
508 	SG(request_info).query_string = apr_pstrdup(r->pool, r->args);
509 	SG(request_info).request_method = r->method;
510 	SG(request_info).proto_num = r->proto_num;
511 	SG(request_info).request_uri = apr_pstrdup(r->pool, r->uri);
512 	SG(request_info).path_translated = apr_pstrdup(r->pool, r->filename);
513 	r->no_local_copy = 1;
514 
515 	content_length = (char *) apr_table_get(r->headers_in, "Content-Length");
516 	if (content_length) {
517 		ZEND_ATOL(SG(request_info).content_length, content_length);
518 	} else {
519 		SG(request_info).content_length = 0;
520 	}
521 
522 	apr_table_unset(r->headers_out, "Content-Length");
523 	apr_table_unset(r->headers_out, "Last-Modified");
524 	apr_table_unset(r->headers_out, "Expires");
525 	apr_table_unset(r->headers_out, "ETag");
526 
527 	auth = apr_table_get(r->headers_in, "Authorization");
528 	php_handle_auth_data(auth);
529 
530 	if (SG(request_info).auth_user == NULL && r->user) {
531 		SG(request_info).auth_user = estrdup(r->user);
532 	}
533 
534 	ctx->r->user = apr_pstrdup(ctx->r->pool, SG(request_info).auth_user);
535 
536 	return php_request_startup();
537 }
538 
php_apache_request_dtor(request_rec * r)539 static void php_apache_request_dtor(request_rec *r)
540 {
541 	php_request_shutdown(NULL);
542 }
543 
php_apache_ini_dtor(request_rec * r,request_rec * p)544 static void php_apache_ini_dtor(request_rec *r, request_rec *p)
545 {
546 	if (strcmp(r->protocol, "INCLUDED")) {
547 		zend_try { zend_ini_deactivate(); } zend_end_try();
548 	} else {
549 typedef struct {
550 	HashTable config;
551 } php_conf_rec;
552 		zend_string *str;
553 		php_conf_rec *c = ap_get_module_config(r->per_dir_config, &php7_module);
554 
555 		ZEND_HASH_FOREACH_STR_KEY(&c->config, str) {
556 			zend_restore_ini_entry(str, ZEND_INI_STAGE_SHUTDOWN);
557 		} ZEND_HASH_FOREACH_END();
558 	}
559 	if (p) {
560 		((php_struct *)SG(server_context))->r = p;
561 	} else {
562 		apr_pool_cleanup_run(r->pool, (void *)&SG(server_context), php_server_context_cleanup);
563 	}
564 }
565 
php_handler(request_rec * r)566 static int php_handler(request_rec *r)
567 {
568 	php_struct * volatile ctx;
569 	void *conf;
570 	apr_bucket_brigade * volatile brigade;
571 	apr_bucket *bucket;
572 	apr_status_t rv;
573 	request_rec * volatile parent_req = NULL;
574 #ifdef ZTS
575 	/* initial resource fetch */
576 	(void)ts_resource(0);
577 	ZEND_TSRMLS_CACHE_UPDATE();
578 #endif
579 
580 #define PHPAP_INI_OFF php_apache_ini_dtor(r, parent_req);
581 
582 	conf = ap_get_module_config(r->per_dir_config, &php7_module);
583 
584 	/* apply_config() needs r in some cases, so allocate server_context early */
585 	ctx = SG(server_context);
586 	if (ctx == NULL || (ctx && ctx->request_processed && !strcmp(r->protocol, "INCLUDED"))) {
587 normal:
588 		ctx = SG(server_context) = apr_pcalloc(r->pool, sizeof(*ctx));
589 		/* register a cleanup so we clear out the SG(server_context)
590 		 * after each request. Note: We pass in the pointer to the
591 		 * server_context in case this is handled by a different thread.
592 		 */
593 		apr_pool_cleanup_register(r->pool, (void *)&SG(server_context), php_server_context_cleanup, apr_pool_cleanup_null);
594 		ctx->r = r;
595 		ctx = NULL; /* May look weird to null it here, but it is to catch the right case in the first_try later on */
596 	} else {
597 		parent_req = ctx->r;
598 		ctx->r = r;
599 	}
600 	apply_config(conf);
601 
602 	if (strcmp(r->handler, PHP_MAGIC_TYPE) && strcmp(r->handler, PHP_SOURCE_MAGIC_TYPE) && strcmp(r->handler, PHP_SCRIPT)) {
603 		/* Check for xbithack in this case. */
604 		if (!AP2(xbithack) || strcmp(r->handler, "text/html") || !(r->finfo.protection & APR_UEXECUTE)) {
605 			PHPAP_INI_OFF;
606 			return DECLINED;
607 		}
608 	}
609 
610 	/* Give a 404 if PATH_INFO is used but is explicitly disabled in
611 	 * the configuration; default behaviour is to accept. */
612 	if (r->used_path_info == AP_REQ_REJECT_PATH_INFO
613 		&& r->path_info && r->path_info[0]) {
614 		PHPAP_INI_OFF;
615 		return HTTP_NOT_FOUND;
616 	}
617 
618 	/* handle situations where user turns the engine off */
619 	if (!AP2(engine)) {
620 		PHPAP_INI_OFF;
621 		return DECLINED;
622 	}
623 
624 	if (r->finfo.filetype == 0) {
625 		php_apache_sapi_log_message_ex("script '%s' not found or unable to stat", r);
626 		PHPAP_INI_OFF;
627 		return HTTP_NOT_FOUND;
628 	}
629 	if (r->finfo.filetype == APR_DIR) {
630 		php_apache_sapi_log_message_ex("attempt to invoke directory '%s' as script", r);
631 		PHPAP_INI_OFF;
632 		return HTTP_FORBIDDEN;
633 	}
634 
635 	/* Setup the CGI variables if this is the main request */
636 	if (r->main == NULL ||
637 		/* .. or if the sub-request environment differs from the main-request. */
638 		r->subprocess_env != r->main->subprocess_env
639 	) {
640 		/* setup standard CGI variables */
641 		ap_add_common_vars(r);
642 		ap_add_cgi_vars(r);
643 	}
644 
645 zend_first_try {
646 
647 	if (ctx == NULL) {
648 		brigade = apr_brigade_create(r->pool, r->connection->bucket_alloc);
649 		ctx = SG(server_context);
650 		ctx->brigade = brigade;
651 
652 		if (php_apache_request_ctor(r, ctx)!=SUCCESS) {
653 			zend_bailout();
654 		}
655 	} else {
656 		if (!parent_req) {
657 			parent_req = ctx->r;
658 		}
659 		if (parent_req && parent_req->handler &&
660 				strcmp(parent_req->handler, PHP_MAGIC_TYPE) &&
661 				strcmp(parent_req->handler, PHP_SOURCE_MAGIC_TYPE) &&
662 				strcmp(parent_req->handler, PHP_SCRIPT)) {
663 			if (php_apache_request_ctor(r, ctx)!=SUCCESS) {
664 				zend_bailout();
665 			}
666 		}
667 
668 		/*
669 		 * check if coming due to ErrorDocument
670 		 * We make a special exception of 413 (Invalid POST request) as the invalidity of the request occurs
671 		 * during processing of the request by PHP during POST processing. Therefor we need to re-use the exiting
672 		 * PHP instance to handle the request rather then creating a new one.
673 		*/
674 		if (parent_req && parent_req->status != HTTP_OK && parent_req->status != 413 && strcmp(r->protocol, "INCLUDED")) {
675 			parent_req = NULL;
676 			goto normal;
677 		}
678 		ctx->r = r;
679 		brigade = ctx->brigade;
680 	}
681 
682 	if (AP2(last_modified)) {
683 		ap_update_mtime(r, r->finfo.mtime);
684 		ap_set_last_modified(r);
685 	}
686 
687 	/* Determine if we need to parse the file or show the source */
688 	if (strncmp(r->handler, PHP_SOURCE_MAGIC_TYPE, sizeof(PHP_SOURCE_MAGIC_TYPE) - 1) == 0) {
689 		zend_syntax_highlighter_ini syntax_highlighter_ini;
690 		php_get_highlight_struct(&syntax_highlighter_ini);
691 		highlight_file((char *)r->filename, &syntax_highlighter_ini);
692 	} else {
693 		zend_file_handle zfd;
694 
695 		zfd.type = ZEND_HANDLE_FILENAME;
696 		zfd.filename = (char *) r->filename;
697 		zfd.free_filename = 0;
698 		zfd.opened_path = NULL;
699 
700 		if (!parent_req) {
701 			php_execute_script(&zfd);
702 		} else {
703 			zend_execute_scripts(ZEND_INCLUDE, NULL, 1, &zfd);
704 		}
705 
706 		apr_table_set(r->notes, "mod_php_memory_usage",
707 			apr_psprintf(ctx->r->pool, "%" APR_SIZE_T_FMT, zend_memory_peak_usage(1)));
708 	}
709 
710 } zend_end_try();
711 
712 	if (!parent_req) {
713 		php_apache_request_dtor(r);
714 		ctx->request_processed = 1;
715 		apr_brigade_cleanup(brigade);
716 		bucket = apr_bucket_eos_create(r->connection->bucket_alloc);
717 		APR_BRIGADE_INSERT_TAIL(brigade, bucket);
718 
719 		rv = ap_pass_brigade(r->output_filters, brigade);
720 		if (rv != APR_SUCCESS || r->connection->aborted) {
721 zend_first_try {
722 			php_handle_aborted_connection();
723 } zend_end_try();
724 		}
725 		apr_brigade_cleanup(brigade);
726 		apr_pool_cleanup_run(r->pool, (void *)&SG(server_context), php_server_context_cleanup);
727 	} else {
728 		ctx->r = parent_req;
729 	}
730 
731 	return OK;
732 }
733 
php_apache_child_init(apr_pool_t * pchild,server_rec * s)734 static void php_apache_child_init(apr_pool_t *pchild, server_rec *s)
735 {
736 	apr_pool_cleanup_register(pchild, NULL, php_apache_child_shutdown, apr_pool_cleanup_null);
737 }
738 
739 #ifdef ZEND_SIGNALS
php_apache_signal_init(apr_pool_t * pchild,server_rec * s)740 static void php_apache_signal_init(apr_pool_t *pchild, server_rec *s)
741 {
742 	zend_signal_init();
743 }
744 #endif
745 
php_ap2_register_hook(apr_pool_t * p)746 void php_ap2_register_hook(apr_pool_t *p)
747 {
748 	ap_hook_pre_config(php_pre_config, NULL, NULL, APR_HOOK_MIDDLE);
749 	ap_hook_post_config(php_apache_server_startup, NULL, NULL, APR_HOOK_MIDDLE);
750 	ap_hook_handler(php_handler, NULL, NULL, APR_HOOK_MIDDLE);
751 #ifdef ZEND_SIGNALS
752 	ap_hook_child_init(php_apache_signal_init, NULL, NULL, APR_HOOK_MIDDLE);
753 #endif
754 	ap_hook_child_init(php_apache_child_init, NULL, NULL, APR_HOOK_MIDDLE);
755 }
756 
757 /*
758  * Local variables:
759  * tab-width: 4
760  * c-basic-offset: 4
761  * End:
762  * vim600: sw=4 ts=4 fdm=marker
763  * vim<600: sw=4 ts=4
764  */
765