From a221e17b41ad4c094908839593a0fd145b682f33 Mon Sep 17 00:00:00 2001
From: Jakub Zelenka <bukka@php.net>
Date: Sat, 28 Nov 2020 21:27:53 +0000
Subject: Fix bug #69625: FPM returns 200 status on request without
 SCRIPT_FILENAME

---
 NEWS                                            |  4 +++
 sapi/fpm/fpm/fpm_main.c                         |  9 ++---
 sapi/fpm/tests/bug69625-no-script-filename.phpt | 45 +++++++++++++++++++++++++
 sapi/fpm/tests/response.inc                     | 28 +++++++++++++++
 sapi/fpm/tests/tester.inc                       |  4 +++
 5 files changed, 84 insertions(+), 6 deletions(-)
 create mode 100644 sapi/fpm/tests/bug69625-no-script-filename.phpt

diff --git a/NEWS b/NEWS
index 20f7da0f02..80c3cdd9c7 100644
--- a/NEWS
+++ b/NEWS
@@ -18,6 +18,10 @@ PHP                                                                        NEWS
 - Fileinfo:
   . Fixed bug #77961 (finfo_open crafted magic parsing SIGABRT). (cmb)
 
+- FPM:
+  . Fixed bug #69625 (FPM returns 200 status on request without
+    SCRIPT_FILENAME env). (Jakub Zelenka)
+
 - Intl:
   . Fixed bug #80425 (MessageFormatAdapter::getArgTypeList redefined). (Nikita)
 
diff --git a/sapi/fpm/fpm/fpm_main.c b/sapi/fpm/fpm/fpm_main.c
index 839ed57eaa..7505afde76 100644
--- a/sapi/fpm/fpm/fpm_main.c
+++ b/sapi/fpm/fpm/fpm_main.c
@@ -973,7 +973,7 @@ static void init_request_info(void)
 
 	/* initialize the defaults */
 	SG(request_info).path_translated = NULL;
-	SG(request_info).request_method = NULL;
+	SG(request_info).request_method = FCGI_GETENV(request, "REQUEST_METHOD");
 	SG(request_info).proto_num = 1000;
 	SG(request_info).query_string = NULL;
 	SG(request_info).request_uri = NULL;
@@ -981,10 +981,8 @@ static void init_request_info(void)
 	SG(request_info).content_length = 0;
 	SG(sapi_headers).http_response_code = 200;
 
-	/* script_path_translated being set is a good indication that
-	 * we are running in a cgi environment, since it is always
-	 * null otherwise.  otherwise, the filename
-	 * of the script will be retrieved later via argc/argv */
+	/* if script_path_translated is not set, then there is no point to carry on
+	 * as the response is 404 and there is no further processing. */
 	if (script_path_translated) {
 		const char *auth;
 		char *content_length = FCGI_GETENV(request, "CONTENT_LENGTH");
@@ -1314,7 +1312,6 @@ static void init_request_info(void)
 			SG(request_info).path_translated = estrdup(script_path_translated);
 		}
 
-		SG(request_info).request_method = FCGI_GETENV(request, "REQUEST_METHOD");
 		/* FIXME - Work out proto_num here */
 		SG(request_info).query_string = FCGI_GETENV(request, "QUERY_STRING");
 		SG(request_info).content_type = (content_type ? content_type : "" );
diff --git a/sapi/fpm/tests/bug69625-no-script-filename.phpt b/sapi/fpm/tests/bug69625-no-script-filename.phpt
new file mode 100644
index 0000000000..9c6478dcf0
--- /dev/null
+++ b/sapi/fpm/tests/bug69625-no-script-filename.phpt
@@ -0,0 +1,45 @@
+--TEST--
+FPM: bug69625 - 404 should be returned on missing SCRIPT_FILENAME
+--SKIPIF--
+<?php include "skipif.inc"; ?>
+--FILE--
+<?php
+
+require_once "tester.inc";
+
+$cfg = <<<EOT
+[global]
+error_log = {{FILE:LOG}}
+[unconfined]
+listen = {{ADDR}}
+pm = dynamic
+pm.max_children = 5
+pm.start_servers = 1
+pm.min_spare_servers = 1
+pm.max_spare_servers = 3
+EOT;
+
+$code = <<<EOT
+<?php
+echo "Test\n";
+EOT;
+
+$tester = new FPM\Tester($cfg, $code);
+$tester->start();
+$tester->expectLogStartNotices();
+$tester
+    ->request('', ['SCRIPT_FILENAME' => null])
+    ->expectHeader('Status', '404 Not Found')
+    ->expectError('Primary script unknown');
+$tester->terminate();
+$tester->close();
+
+?>
+Done
+--EXPECT--
+Done
+--CLEAN--
+<?php
+require_once "tester.inc";
+FPM\Tester::clean();
+?>
diff --git a/sapi/fpm/tests/response.inc b/sapi/fpm/tests/response.inc
index 54f85bcfb6..7ee9cd4640 100644
--- a/sapi/fpm/tests/response.inc
+++ b/sapi/fpm/tests/response.inc
@@ -98,6 +98,34 @@ class Response
         return $this->expectBody('');
     }
 
+    /**
+     * @param string $name
+     * @param string $value
+     * @return Response
+     */
+    public function expectHeader($name, $value)
+    {
+        $this->checkHeader($name, $value);
+
+        return $this;
+    }
+
+    /**
+     * @param string $errorMessage
+     * @return Response
+     */
+    public function expectError($errorMessage)
+    {
+        $errorData = $this->getErrorData();
+        if ($errorData !== $errorMessage) {
+            $this->error(
+                "The expected error message '$errorMessage' is not equal to returned error '$errorData'"
+            );
+        }
+
+        return $this;
+    }
+
     /**
      * @param string $contentType
      * @return string|null
diff --git a/sapi/fpm/tests/tester.inc b/sapi/fpm/tests/tester.inc
index da5719b064..5c57652d88 100644
--- a/sapi/fpm/tests/tester.inc
+++ b/sapi/fpm/tests/tester.inc
@@ -564,6 +564,10 @@ class Tester
             ],
             $headers
         );
+        $params = array_filter($params, function($value) {
+            return !is_null($value);
+        });
+
         try {
             $this->response = new Response(
                 $this->getClient($address, $connKeepAlive)->request_data($params, false)
-- 
cgit v1.2.1