prevent user from making nested PHP requests using virtual()

1 files changed, 11 insertions, 1 deletions

diff --git a/sapi/nsapi/nsapi.c b/sapi/nsapi/nsapi.c
index ebbf470c9b..73801dbaea 100644
--- a/sapi/nsapi/nsapi.c
+++ b/sapi/nsapi/nsapi.c
@@ -198,7 +198,7 @@ zend_module_entry nsapi_module_entry = {
 	NULL,
 	NULL,
 	PHP_MINFO(nsapi),
-	"$Id$",
+	"$Revision$",
 	STANDARD_MODULE_PROPERTIES
 };
 /* }}} */
@@ -822,6 +822,15 @@ int NSAPI_PUBLIC php4_execute(pblock *pb, Session *sn, Request *rq)
 
 	TSRMLS_FETCH();
 
+	/* check if this uri was included in an other PHP script with virtual()
+	   by looking for a request context in the current thread */
+	if (SG(server_context)) {
+		/* send 500 internal server error */
+		log_error(LOG_WARN, "php4_execute", sn, rq, "Cannot make nesting PHP requests with virtual()");
+		protocol_status(sn, rq, 500, NULL);
+		return REQ_ABORTED;
+	}
+
 	request_context = (nsapi_request_context *)MALLOC(sizeof(nsapi_request_context));
 	request_context->pb = pb;
 	request_context->sn = sn;
@@ -869,6 +878,7 @@ int NSAPI_PUBLIC php4_execute(pblock *pb, Session *sn, Request *rq)
 	nsapi_free((void*)(SG(request_info).content_type));
 
 	FREE(request_context);
+	SG(server_context) = NULL;
 
 	return retval;
 }