Home » HTML » HTML_QuickForm » Bug #4098
buggy use of $_SERVER['PHP_SELF'] for default action
Details
| Submitted | 2005-04-07 17:00 UTC |
|---|---|
| From | michael at emaxware dot com |
| Status | Wont fix |
| Package | HTML_QuickForm |
| PHP Version | 4.3.6 |
| OS | FreeBSD |
| Roadmaps | (Not assigned) |
Comments
[2005-04-07 17:00 UTC] michael at emaxware dot com
Description:
------------
using $_SERVER["SCRIPT_URL"] seems to work better.
This is at line 253 in QuickForm.php.
Reproduce code:
---------------
diff -U3 -r1.1 QuickForm.php
--- pear/PEAR/HTML/QuickForm.php 7 Apr 2005 14:42:48 -0000 1.1
+++ pear/PEAR/HTML/QuickForm.php 7 Apr 2005 16:55:01 -0000
@@ -250,7 +250,7 @@
{
HTML_Common::HTML_Common($attributes);
$method = (strtoupper($method) == 'GET') ? 'get' : 'post';
- $action = ($action == '') ? $_SERVER['PHP_SELF'] : $action;
+ $action = ($action == '') ? $_SERVER["SCRIPT_URL"] : $action;
$target = (empty($target) || $target == '_self') ? array() : array('target' => $target);
$attributes = array('action'=>$action, 'method'=>$method, 'name'=>$formName, 'id'=>$formName) + $target;
$this->updateAttributes($attributes);
[2005-04-08 05:13 UTC] michael at emaxware dot com
Granted, this condition probably is not too common, but
I'm sure its not unheard of. I'm dealing with installing
pear on a server to which I only have ftp access and
moderate apache tweaking. I have a subdomain
http://xxx.domain.com/myapp.php which is mapped to an
actual url of http://domain.com/xxx/myapp.php. When using
the first URL, PHP_SELF = /xxx/myapp.php, while SCRIPT_URL
= /myapp.php. When constructing the default action URL
for the form, /myapp.php, using PHP_SELF obviously does
not work, while SCRIPT_URL does. Its not clear to me
under what conditions SCRIPT_URL is not available. At the
very least, I would think it should be used first, if
available, then fall back to PHP_SELF.
[2005-04-08 05:22 UTC] michael at emaxware dot com
As I see it, PHP_SELF reflects the underlying PHP file
system structure, while SCRIPT_URL reflects the script's
domain context. Often those two are in sync, but when
they aren't, as in this case, SCRIPT_URL seems more
accurate when constructing a URL. I would imagine any
configuration that uses some kind of virtual hosting could
run into this kind of problem.