3 ms·
Yup and this sounds like a massive security hole in PHP if you can change $_SERVER elements like 'REMOTE_ADDR' with headers.
by zodiakzz 11y ago
Yup and this sounds like a massive security hole in PHP if you can change $_SERVER elements like 'REMOTE_ADDR' with headers.
- deleted 11y ago[deleted]
- nolok 11y agoIt's not in PHP, its in Apache. Apache's the one in charge of reading the request and passing to PHP the server variables, it's the one who made the contract that HTTPS means the request was made over HTTPS, it's the one who send to the called handler the value of HTTPS and it's also the one who put the wrong value in it. It wrongly put the browser-sent header in there overwriting it's own variable (or creating it when it shouldn't).