PHP :: Bug #27530 :: safe_mode breaks authorization via header() in 4.3.5RC2, too

 [2004-03-08 17:49 UTC] arekm at pld-linux dot org

Description:
------------
The problem is that when safe_mode = On and we have simple script:
<?php
  header('WWW-Authenticate: Basic realm=\"log in\"');
  header('HTTP/1.0 401 Unauthorized');
  exit;
?>
and I get
 3 Server: Apache/2.0.48 (Unix) mod_fastcgi/2.4.2 mod_ssl/2.0.48 OpenSSL/0.9.7c DAV/2
 4 X-Powered-By: PHP/4.3.5RC2
 5 WWW-Authenticate: 1000
which is unknown authentication method for any browser.
According to documentation (http://pl2.php.net/manual/en/features.safe-mode.functions.php) UID should be appended to user specified string.
Tested in on different setups like apache 1.3.29+php 4.3.3, php 4.3.4, apache 2.0.48+php 4.3.5RC2 in fastcgi mode, without fastcgi mode. Always reproducible.
Turning safe_mode = Off fixes problem of course.
Reproduce code:
---------------
See description.
Expected result:
----------------
 3 Server: Apache/2.0.48 (Unix) mod_fastcgi/2.4.2 mod_ssl/2.0.48 OpenSSL/0.9.7c DAV/2
 4 X-Powered-By: PHP/4.3.5RC2
 5 WWW-Authenticate: Basic realm=\"log in\"
+ somehwere UID since that's safe mode.
Actual result:
--------------
 3 Server: Apache/2.0.48 (Unix) mod_fastcgi/2.4.2 mod_ssl/2.0.48 OpenSSL/0.9.7c DAV/2
 4 X-Powered-By: PHP/4.3.5RC2
 5 WWW-Authenticate: 1000

 [2004-03-08 21:16 UTC] iliaa@php.net

This bug has been fixed in CVS.
Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
Thank you for the report, and for helping us make PHP better.