From: Rasmus Lerdorf <rasmus@php.net>
Date: Sun, 21 Oct 2001 00:03:55 +0000 (+0000)
Subject: This made no sense before.  Hide Authorization in getallheaders() but
X-Git-Tag: POST_PARAMETER_PARSING_API~65
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=95dff71df7fb08e9e4e690b90143425b0b7ed704;p=php

This made no sense before.  Hide Authorization in getallheaders() but
display it from phpinfo()?  Ouch!
@ Hide Authorization header from phpinfo() output in safe_mode (Rasmus)
---

diff --git a/sapi/apache/php_apache.c b/sapi/apache/php_apache.c
index 6c995aa171..5a1b835459 100644
--- a/sapi/apache/php_apache.c
+++ b/sapi/apache/php_apache.c
@@ -278,7 +278,7 @@ PHP_MINFO_FUNCTION(apache)
 		env_arr = table_elts(r->headers_in);
 		env = (table_entry *)env_arr->elts;
 		for (i = 0; i < env_arr->nelts; ++i) {
-			if (env[i].key) {
+			if (env[i].key && (!PG(safe_mode) || (PG(safe_mode) && strncasecmp(env[i].key, "authorization", 13)))) {
 				php_info_print_table_row(2, env[i].key, env[i].val);
 			}
 		}