Data passed to HHVM ($_SERVER variables) is a mixed bag of already-decoded and non-decoded nonsense
Closed, ResolvedPublic
Actions

Assigned To

None

Authored By

	matmarex
	Apr 13 2016, 8:45 PM

Description

According to @Joe at T128380#2072420, data passed to HHVM (accessible as $_SERVER variables in PHP code) is a mixed bag of already-decoded and non-decoded nonsense. This is the cause of at least three distinct bugs so far (one of which broke all cross-wiki stuff for a few hours until we figured it out). It would be good to debug this before it bites us again.

Related Objects
Search...

Status	Assigned	Task
Resolved	He7d3r	T123060 Error: module already implemented: user.options on ptwiki
Resolved	Krinkle	T123062 mw.util.getUrl should produce working URLs for titles ending in "?"
Resolved	None	T123276 URL parameters do not work with pages that have "?" in their names
Resolved	None	T128380 Redirect with a question mark '?' in the title treats everything following it as URL query part when updating the URL
		Restricted Task
Duplicate	None	T153275 URL to pagenames with special characters fail
Resolved	None	T201072 [[?oldid=851713451]] is a valid link in the new preview, but not when the page is saved
Resolved	None	T132629 Data passed to HHVM ($_SERVER variables) is a mixed bag of already-decoded and non-decoded nonsense
Resolved	Danny_B	T139271 wgRedirectedFrom not populated/exposed if redirect accessed via index.php?title=Redirect_page

Event Timeline

matmarex created this task.Apr 13 2016, 8:45 PM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptApr 13 2016, 8:45 PM

matmarex added a parent task: T123276: URL parameters do not work with pages that have "?" in their names.Apr 13 2016, 8:45 PM

matmarex added a parent task: T128380: Redirect with a question mark '?' in the title treats everything following it as URL query part when updating the URL.

matmarex added a parent task: T132612: api.php gives a 302 redirect to URL with '&*' appended, breaking CORS requests.

matmarex mentioned this in T132612: api.php gives a 302 redirect to URL with '&*' appended, breaking CORS requests.Apr 13 2016, 9:05 PM

Some examples courtesy of @ori, for each of the bugs mentioned above. (Something went wrong with the URL in the first one, but that shouldn't matter here.)

P2895 var_dump( $_SERVER ) for: https://commons.wikimedia.org/w/api.php?oxrigin=https%3A%2F%2Fwww.mediawiki.org&*

1	array(53) {
2	["REQUEST_START_TIME"]=>
3	int(1460582150)
4	["REQUEST_TIME"]=>
5	int(1460582150)
6	["REQUEST_TIME_FLOAT"]=>
7	float(1460582150.8149)
8	["HTTP_ACCEPT_ENCODING"]=>
9	string(4) "gzip"
10	["HTTP_ACCEPT_LANGUAGE"]=>
11	string(23) "en-US,en;q=0.8,he;q=0.6"
12	["HTTP_X_FORWARDED_PROTO"]=>
13	string(5) "https"
14	["HTTP_X_CLIENT_IP"]=>
15	string(12) "198.73.209.4"
16	["HTTP_CONNECTION"]=>
17	string(5) "close"
18	["HTTP_X_CONNECTION_PROPERTIES"]=>
19	string(62) "SPDY=3.1; SSR=1; SSL=TLSv1.2; C=ECDHE-ECDSA-AES128-GCM-SHA256;"
20	["HTTP_X_VARNISH"]=>
21	string(46) "1096453307, 2202294892, 1333998961, 1664847115"
22	["HTTP_USER_AGENT"]=>
23	string(119) "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2683.0 Safari/537.36"
24	["HTTP_X_WMF_LASTSTAMP"]=>
25	string(11) "13-Apr-2016"
26	["HTTP_CONTENT_TYPE"]=>
27	string(0) ""
28	["HTTP_UPGRADE_INSECURE_REQUESTS"]=>
29	string(1) "1"
30	["HTTP_X_FORWARDED_FOR"]=>
31	string(89) "198.73.209.4, 10.128.0.118, 10.128.0.118, 10.128.0.117, 10.192.48.27, ::ffff:10.64.32.105"
32	["HTTP_AUTHORIZATION"]=>
33	string(0) ""
34	["HTTP_CONTENT_LENGTH"]=>
35	string(0) ""
36	["HTTP_HOST"]=>
37	string(21) "commons.wikimedia.org"
38	["HTTP_CACHE_CONTROL"]=>
39	string(9) "max-age=0"
40	["HTTP_X_WIKIMEDIA_DEBUG"]=>
41	string(26) "backend=mw1099.eqiad.wmnet"
42	["HTTP_ACCEPT"]=>
43	string(74) "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8"
44	["GATEWAY_INTERFACE"]=>
45	string(7) "CGI/1.1"
46	["SERVER_ADDR"]=>
47	string(11) "10.64.16.79"
48	["SERVER_NAME"]=>
49	string(21) "commons.wikimedia.org"
50	["SERVER_PORT"]=>
51	string(2) "80"
52	["SERVER_SOFTWARE"]=>
53	string(18) "mw1099.eqiad.wmnet"
54	["SERVER_PROTOCOL"]=>
55	string(8) "HTTP/1.0"
56	["SERVER_ADMIN"]=>
57	string(23) "webmaster@wikimedia.org"
58	["SERVER_SIGNATURE"]=>
59	string(0) ""
60	["SCRIPT_NAME"]=>
61	string(10) "/w/api.php"
62	["proxy-nokeepalive"]=>
63	string(1) "1"
64	["SCRIPT_FILENAME"]=>
65	string(40) "/srv/mediawiki/docroot/commons/w/api.php"
66	["CONTEXT_DOCUMENT_ROOT"]=>
67	string(30) "/srv/mediawiki/docroot/commons"
68	["REQUEST_SCHEME"]=>
69	string(4) "http"
70	["REMOTE_PORT"]=>
71	int(50763)
72	["REMOTE_ADDR"]=>
73	string(13) "10.192.16.173"
74	["QUERY_STRING"]=>
75	string(41) "oxrigin=https%3A%2F%2Fwww.mediawiki.org&*"
76	["REQUEST_URI"]=>
77	string(52) "/w/api.php?oxrigin=https%3A%2F%2Fwww.mediawiki.org&*"
78	["CONTEXT_PREFIX"]=>
79	string(0) ""
80	["REQUEST_METHOD"]=>
81	string(3) "GET"
82	["UNIQUE_ID"]=>
83	string(24) "Vw63BgpAEE8AACnUh@UAAAAJ"
84	["SCRIPT_URI"]=>
85	string(38) "http://commons.wikimedia.org/w/api.php"
86	["DOCUMENT_ROOT"]=>
87	string(30) "/srv/mediawiki/docroot/commons"
88	["PATH"]=>
89	string(60) "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
90	["RW_PROTO"]=>
91	string(5) "https"
92	["SCRIPT_URL"]=>
93	string(10) "/w/api.php"
94	["PHP_SELF"]=>
95	string(10) "/w/api.php"
96	["PATH_TRANSLATED"]=>
97	string(40) "/srv/mediawiki/docroot/commons/w/api.php"
98	["HTTPS"]=>
99	string(0) ""
100	["argv"]=>
101	array(1) {
102	[0]=>
103	string(41) "oxrigin=https%3A%2F%2Fwww.mediawiki.org&*"
104	}
105	["argc"]=>
106	int(1)
107	["THREAD_TYPE"]=>
108	string(11) "Web Request"
109	}

P2896 var_dump( $_SERVER ) for: https://en.wikipedia.org/wiki/Why_Me%3F_(Daniel_Johnston_Album)

1	array(52) {
2	["REQUEST_START_TIME"]=>
3	int(1460582202)
4	["REQUEST_TIME"]=>
5	int(1460582202)
6	["REQUEST_TIME_FLOAT"]=>
7	float(1460582202.9377)
8	["HTTP_ACCEPT_ENCODING"]=>
9	string(4) "gzip"
10	["HTTP_ACCEPT_LANGUAGE"]=>
11	string(23) "en-US,en;q=0.8,he;q=0.6"
12	["HTTP_X_FORWARDED_PROTO"]=>
13	string(5) "https"
14	["HTTP_X_WIKIMEDIA_DEBUG"]=>
15	string(26) "backend=mw1099.eqiad.wmnet"
16	["HTTP_ACCEPT"]=>
17	string(74) "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8"
18	["HTTP_X_WMF_LASTSTAMP"]=>
19	string(11) "13-Apr-2016"
20	["HTTP_CONTENT_TYPE"]=>
21	string(0) ""
22	["HTTP_UPGRADE_INSECURE_REQUESTS"]=>
23	string(1) "1"
24	["HTTP_X_FORWARDED_FOR"]=>
25	string(89) "198.73.209.4, 10.128.0.118, 10.128.0.118, 10.128.0.109, 10.192.32.115, ::ffff:10.64.0.103"
26	["HTTP_AUTHORIZATION"]=>
27	string(0) ""
28	["HTTP_CONTENT_LENGTH"]=>
29	string(0) ""
30	["HTTP_HOST"]=>
31	string(16) "en.wikipedia.org"
32	["HTTP_USER_AGENT"]=>
33	string(119) "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2683.0 Safari/537.36"
34	["HTTP_X_CONNECTION_PROPERTIES"]=>
35	string(62) "SPDY=3.1; SSR=1; SSL=TLSv1.2; C=ECDHE-ECDSA-AES128-GCM-SHA256;"
36	["HTTP_X_VARNISH"]=>
37	string(45) "1096659900, 1290799771, 2016683006, 937875487"
38	["HTTP_CONNECTION"]=>
39	string(5) "close"
40	["HTTP_X_CLIENT_IP"]=>
41	string(12) "198.73.209.4"
42	["GATEWAY_INTERFACE"]=>
43	string(7) "CGI/1.1"
44	["SERVER_ADDR"]=>
45	string(11) "10.64.16.79"
46	["SERVER_NAME"]=>
47	string(16) "en.wikipedia.org"
48	["SERVER_PORT"]=>
49	string(2) "80"
50	["SERVER_SOFTWARE"]=>
51	string(18) "mw1099.eqiad.wmnet"
52	["SERVER_PROTOCOL"]=>
53	string(8) "HTTP/1.0"
54	["SERVER_ADMIN"]=>
55	string(23) "webmaster@wikimedia.org"
56	["SERVER_SIGNATURE"]=>
57	string(0) ""
58	["SCRIPT_NAME"]=>
59	string(12) "/w/index.php"
60	["UNIQUE_ID"]=>
61	string(24) "Vw63OgpAEE8AACnUh@0AAAAA"
62	["SCRIPT_FILENAME"]=>
63	string(48) "/srv/mediawiki/docroot/wikipedia.org/w/index.php"
64	["CONTEXT_PREFIX"]=>
65	string(0) ""
66	["REMOTE_PORT"]=>
67	int(50767)
68	["REMOTE_ADDR"]=>
69	string(13) "10.192.16.173"
70	["QUERY_STRING"]=>
71	string(24) "_(Daniel_Johnston_Album)"
72	["REQUEST_URI"]=>
73	string(39) "/wiki/Why_Me%3F_(Daniel_Johnston_Album)"
74	["REQUEST_SCHEME"]=>
75	string(4) "http"
76	["CONTEXT_DOCUMENT_ROOT"]=>
77	string(36) "/srv/mediawiki/docroot/wikipedia.org"
78	["REQUEST_METHOD"]=>
79	string(3) "GET"
80	["RW_PROTO"]=>
81	string(5) "https"
82	["SCRIPT_URI"]=>
83	string(69) "http://en.wikipedia.org/w/index.php/Why_Me%3F_(Daniel_Johnston_Album)"
84	["DOCUMENT_ROOT"]=>
85	string(36) "/srv/mediawiki/docroot/wikipedia.org"
86	["PATH"]=>
87	string(60) "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
88	["SCRIPT_URL"]=>
89	string(46) "/w/index.php/Why_Me%3F_(Daniel_Johnston_Album)"
90	["PHP_SELF"]=>
91	string(46) "/w/index.php/Why_Me%3F_(Daniel_Johnston_Album)"
92	["PATH_TRANSLATED"]=>
93	string(82) "/srv/mediawiki/docroot/wikipedia.org/w/index.php/Why_Me%3F_(Daniel_Johnston_Album)"
94	["PATH_INFO"]=>
95	string(34) "/Why_Me%3F_(Daniel_Johnston_Album)"
96	["HTTPS"]=>
97	string(0) ""
98	["argv"]=>
99	array(1) {
100	[0]=>
101	string(24) "_(Daniel_Johnston_Album)"
102	}
103	["argc"]=>
104	int(1)
105	["THREAD_TYPE"]=>
106	string(11) "Web Request"
107	}

P2897 var_dump( $_SERVER ) for: https://test.wikipedia.org/wiki/Bug%3F?action=history

1	array(52) {
2	["REQUEST_START_TIME"]=>
3	int(1460582244)
4	["REQUEST_TIME"]=>
5	int(1460582244)
6	["REQUEST_TIME_FLOAT"]=>
7	float(1460582244.894)
8	["HTTP_ACCEPT_ENCODING"]=>
9	string(4) "gzip"
10	["HTTP_ACCEPT_LANGUAGE"]=>
11	string(23) "en-US,en;q=0.8,he;q=0.6"
12	["HTTP_X_FORWARDED_PROTO"]=>
13	string(5) "https"
14	["HTTP_X_WIKIMEDIA_DEBUG"]=>
15	string(26) "backend=mw1099.eqiad.wmnet"
16	["HTTP_ACCEPT"]=>
17	string(74) "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8"
18	["HTTP_X_WMF_LASTSTAMP"]=>
19	string(11) "13-Apr-2016"
20	["HTTP_CONTENT_TYPE"]=>
21	string(0) ""
22	["HTTP_UPGRADE_INSECURE_REQUESTS"]=>
23	string(1) "1"
24	["HTTP_X_FORWARDED_FOR"]=>
25	string(88) "198.73.209.4, 10.128.0.118, 10.128.0.118, 10.128.0.118, 10.192.48.27, ::ffff:10.64.0.103"
26	["HTTP_AUTHORIZATION"]=>
27	string(0) ""
28	["HTTP_CONTENT_LENGTH"]=>
29	string(0) ""
30	["HTTP_HOST"]=>
31	string(18) "test.wikipedia.org"
32	["HTTP_USER_AGENT"]=>
33	string(119) "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2683.0 Safari/537.36"
34	["HTTP_X_CONNECTION_PROPERTIES"]=>
35	string(62) "SPDY=3.1; SSR=1; SSL=TLSv1.2; C=ECDHE-ECDSA-AES128-GCM-SHA256;"
36	["HTTP_X_VARNISH"]=>
37	string(45) "1096838882, 2136824363, 1334283981, 938046233"
38	["HTTP_CONNECTION"]=>
39	string(5) "close"
40	["HTTP_X_CLIENT_IP"]=>
41	string(12) "198.73.209.4"
42	["GATEWAY_INTERFACE"]=>
43	string(7) "CGI/1.1"
44	["SERVER_ADDR"]=>
45	string(11) "10.64.16.79"
46	["SERVER_NAME"]=>
47	string(18) "test.wikipedia.org"
48	["SERVER_PORT"]=>
49	string(2) "80"
50	["SERVER_SOFTWARE"]=>
51	string(18) "mw1099.eqiad.wmnet"
52	["SERVER_PROTOCOL"]=>
53	string(8) "HTTP/1.0"
54	["SERVER_ADMIN"]=>
55	string(23) "webmaster@wikimedia.org"
56	["SERVER_SIGNATURE"]=>
57	string(0) ""
58	["SCRIPT_NAME"]=>
59	string(12) "/w/index.php"
60	["UNIQUE_ID"]=>
61	string(24) "Vw63ZApAEE8AACnUh-IAAAAW"
62	["SCRIPT_FILENAME"]=>
63	string(48) "/srv/mediawiki/docroot/wikipedia.org/w/index.php"
64	["CONTEXT_PREFIX"]=>
65	string(0) ""
66	["REMOTE_PORT"]=>
67	int(50768)
68	["REMOTE_ADDR"]=>
69	string(13) "10.192.16.173"
70	["QUERY_STRING"]=>
71	string(15) "?action=history"
72	["REQUEST_URI"]=>
73	string(27) "/wiki/Bug%3F?action=history"
74	["REQUEST_SCHEME"]=>
75	string(4) "http"
76	["CONTEXT_DOCUMENT_ROOT"]=>
77	string(36) "/srv/mediawiki/docroot/wikipedia.org"
78	["REQUEST_METHOD"]=>
79	string(3) "GET"
80	["RW_PROTO"]=>
81	string(5) "https"
82	["SCRIPT_URI"]=>
83	string(44) "http://test.wikipedia.org/w/index.php/Bug%3F"
84	["DOCUMENT_ROOT"]=>
85	string(36) "/srv/mediawiki/docroot/wikipedia.org"
86	["PATH"]=>
87	string(60) "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
88	["SCRIPT_URL"]=>
89	string(19) "/w/index.php/Bug%3F"
90	["PHP_SELF"]=>
91	string(19) "/w/index.php/Bug%3F"
92	["PATH_TRANSLATED"]=>
93	string(55) "/srv/mediawiki/docroot/wikipedia.org/w/index.php/Bug%3F"
94	["PATH_INFO"]=>
95	string(7) "/Bug%3F"
96	["HTTPS"]=>
97	string(0) ""
98	["argv"]=>
99	array(1) {
100	[0]=>
101	string(15) "?action=history"
102	}
103	["argc"]=>
104	int(1)
105	["THREAD_TYPE"]=>
106	string(11) "Web Request"
107	}

And for comparison, similar requests from my local testing wiki, with Apache and a very vanilla short URLs setup:

P2899 var_dump( $_SERVER ) for: http://localhost:3080/w/api.php?oxrigin=https%3A%2F%2Fwww.mediawiki.org&*

1	array(31) {
2	["HTTP_HOST"]=>
3	string(14) "localhost:3080"
4	["HTTP_CONNECTION"]=>
5	string(10) "keep-alive"
6	["HTTP_ACCEPT"]=>
7	string(74) "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8"
8	["HTTP_UPGRADE_INSECURE_REQUESTS"]=>
9	string(1) "1"
10	["HTTP_USER_AGENT"]=>
11	string(140) "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.57 Safari/537.36 OPR/37.0.2178.10 (Edition beta)"
12	["HTTP_ACCEPT_ENCODING"]=>
13	string(25) "gzip, deflate, lzma, sdch"
14	["HTTP_ACCEPT_LANGUAGE"]=>
15	string(14) "en-US,en;q=0.8"
16	["HTTP_COOKIE"]=>
17	string(223) "mediawikichangeslist-state=expanded; stopMobileRedirect=true; mediawiki_session=vq34pqtcn25br29m2074cbqam49m7cni; mediawikiUserID=1; mediawikiUserName=Matma+Rex; mediawikiToken=ceb8cdf4615f4290f3acb27a61df9f24; VEE=wikitext"
18	["PATH"]=>
19	string(60) "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
20	["SERVER_SIGNATURE"]=>
21	string(72) "<address>Apache/2.4.12 (Ubuntu) Server at localhost Port 3080</address>
22	"
23	["SERVER_SOFTWARE"]=>
24	string(22) "Apache/2.4.12 (Ubuntu)"
25	["SERVER_NAME"]=>
26	string(9) "localhost"
27	["SERVER_ADDR"]=>
28	string(9) "10.0.2.15"
29	["SERVER_PORT"]=>
30	string(4) "3080"
31	["REMOTE_ADDR"]=>
32	string(8) "10.0.2.2"
33	["DOCUMENT_ROOT"]=>
34	string(13) "/var/www/html"
35	["REQUEST_SCHEME"]=>
36	string(4) "http"
37	["CONTEXT_PREFIX"]=>
38	string(0) ""
39	["CONTEXT_DOCUMENT_ROOT"]=>
40	string(13) "/var/www/html"
41	["SERVER_ADMIN"]=>
42	string(19) "webmaster@localhost"
43	["SCRIPT_FILENAME"]=>
44	string(23) "/var/www/html/w/api.php"
45	["REMOTE_PORT"]=>
46	string(5) "60080"
47	["GATEWAY_INTERFACE"]=>
48	string(7) "CGI/1.1"
49	["SERVER_PROTOCOL"]=>
50	string(8) "HTTP/1.1"
51	["REQUEST_METHOD"]=>
52	string(3) "GET"
53	["QUERY_STRING"]=>
54	string(41) "oxrigin=https%3A%2F%2Fwww.mediawiki.org&*"
55	["REQUEST_URI"]=>
56	string(52) "/w/api.php?oxrigin=https%3A%2F%2Fwww.mediawiki.org&*"
57	["SCRIPT_NAME"]=>
58	string(10) "/w/api.php"
59	["PHP_SELF"]=>
60	string(10) "/w/api.php"
61	["REQUEST_TIME_FLOAT"]=>
62	float(1460584040.467)
63	["REQUEST_TIME"]=>
64	int(1460584040)
65	}

P2900 var_dump( $_SERVER ) for: http://localhost:3080/wiki/Why_Me%3F_(Daniel_Johnston_Album)

1	array(33) {
2	["REDIRECT_STATUS"]=>
3	string(3) "200"
4	["HTTP_HOST"]=>
5	string(14) "localhost:3080"
6	["HTTP_CONNECTION"]=>
7	string(10) "keep-alive"
8	["HTTP_ACCEPT"]=>
9	string(74) "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8"
10	["HTTP_UPGRADE_INSECURE_REQUESTS"]=>
11	string(1) "1"
12	["HTTP_USER_AGENT"]=>
13	string(140) "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.57 Safari/537.36 OPR/37.0.2178.10 (Edition beta)"
14	["HTTP_ACCEPT_ENCODING"]=>
15	string(25) "gzip, deflate, lzma, sdch"
16	["HTTP_ACCEPT_LANGUAGE"]=>
17	string(14) "en-US,en;q=0.8"
18	["HTTP_COOKIE"]=>
19	string(223) "mediawikichangeslist-state=expanded; stopMobileRedirect=true; mediawiki_session=vq34pqtcn25br29m2074cbqam49m7cni; mediawikiUserID=1; mediawikiUserName=Matma+Rex; mediawikiToken=ceb8cdf4615f4290f3acb27a61df9f24; VEE=wikitext"
20	["PATH"]=>
21	string(60) "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
22	["SERVER_SIGNATURE"]=>
23	string(72) "<address>Apache/2.4.12 (Ubuntu) Server at localhost Port 3080</address>
24	"
25	["SERVER_SOFTWARE"]=>
26	string(22) "Apache/2.4.12 (Ubuntu)"
27	["SERVER_NAME"]=>
28	string(9) "localhost"
29	["SERVER_ADDR"]=>
30	string(9) "10.0.2.15"
31	["SERVER_PORT"]=>
32	string(4) "3080"
33	["REMOTE_ADDR"]=>
34	string(8) "10.0.2.2"
35	["DOCUMENT_ROOT"]=>
36	string(13) "/var/www/html"
37	["REQUEST_SCHEME"]=>
38	string(4) "http"
39	["CONTEXT_PREFIX"]=>
40	string(0) ""
41	["CONTEXT_DOCUMENT_ROOT"]=>
42	string(13) "/var/www/html"
43	["SERVER_ADMIN"]=>
44	string(19) "webmaster@localhost"
45	["SCRIPT_FILENAME"]=>
46	string(25) "/var/www/html/w/index.php"
47	["REMOTE_PORT"]=>
48	string(5) "60084"
49	["REDIRECT_URL"]=>
50	string(37) "/wiki/Why_Me?_(Daniel_Johnston_Album)"
51	["GATEWAY_INTERFACE"]=>
52	string(7) "CGI/1.1"
53	["SERVER_PROTOCOL"]=>
54	string(8) "HTTP/1.1"
55	["REQUEST_METHOD"]=>
56	string(3) "GET"
57	["QUERY_STRING"]=>
58	string(0) ""
59	["REQUEST_URI"]=>
60	string(39) "/wiki/Why_Me%3F_(Daniel_Johnston_Album)"
61	["SCRIPT_NAME"]=>
62	string(12) "/w/index.php"
63	["PHP_SELF"]=>
64	string(12) "/w/index.php"
65	["REQUEST_TIME_FLOAT"]=>
66	float(1460584072.104)
67	["REQUEST_TIME"]=>
68	int(1460584072)
69	}

P2901 var_dump( $_SERVER ) for: http://localhost:3080/wiki/Bug%3F?action=history

1	array(34) {
2	["REDIRECT_STATUS"]=>
3	string(3) "200"
4	["HTTP_HOST"]=>
5	string(14) "localhost:3080"
6	["HTTP_CONNECTION"]=>
7	string(10) "keep-alive"
8	["HTTP_ACCEPT"]=>
9	string(74) "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8"
10	["HTTP_UPGRADE_INSECURE_REQUESTS"]=>
11	string(1) "1"
12	["HTTP_USER_AGENT"]=>
13	string(140) "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.57 Safari/537.36 OPR/37.0.2178.10 (Edition beta)"
14	["HTTP_ACCEPT_ENCODING"]=>
15	string(25) "gzip, deflate, lzma, sdch"
16	["HTTP_ACCEPT_LANGUAGE"]=>
17	string(14) "en-US,en;q=0.8"
18	["HTTP_COOKIE"]=>
19	string(223) "mediawikichangeslist-state=expanded; stopMobileRedirect=true; mediawiki_session=vq34pqtcn25br29m2074cbqam49m7cni; mediawikiUserID=1; mediawikiUserName=Matma+Rex; mediawikiToken=ceb8cdf4615f4290f3acb27a61df9f24; VEE=wikitext"
20	["PATH"]=>
21	string(60) "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
22	["SERVER_SIGNATURE"]=>
23	string(72) "<address>Apache/2.4.12 (Ubuntu) Server at localhost Port 3080</address>
24	"
25	["SERVER_SOFTWARE"]=>
26	string(22) "Apache/2.4.12 (Ubuntu)"
27	["SERVER_NAME"]=>
28	string(9) "localhost"
29	["SERVER_ADDR"]=>
30	string(9) "10.0.2.15"
31	["SERVER_PORT"]=>
32	string(4) "3080"
33	["REMOTE_ADDR"]=>
34	string(8) "10.0.2.2"
35	["DOCUMENT_ROOT"]=>
36	string(13) "/var/www/html"
37	["REQUEST_SCHEME"]=>
38	string(4) "http"
39	["CONTEXT_PREFIX"]=>
40	string(0) ""
41	["CONTEXT_DOCUMENT_ROOT"]=>
42	string(13) "/var/www/html"
43	["SERVER_ADMIN"]=>
44	string(19) "webmaster@localhost"
45	["SCRIPT_FILENAME"]=>
46	string(25) "/var/www/html/w/index.php"
47	["REMOTE_PORT"]=>
48	string(5) "60085"
49	["REDIRECT_QUERY_STRING"]=>
50	string(14) "action=history"
51	["REDIRECT_URL"]=>
52	string(10) "/wiki/Bug?"
53	["GATEWAY_INTERFACE"]=>
54	string(7) "CGI/1.1"
55	["SERVER_PROTOCOL"]=>
56	string(8) "HTTP/1.1"
57	["REQUEST_METHOD"]=>
58	string(3) "GET"
59	["QUERY_STRING"]=>
60	string(14) "action=history"
61	["REQUEST_URI"]=>
62	string(27) "/wiki/Bug%3F?action=history"
63	["SCRIPT_NAME"]=>
64	string(12) "/w/index.php"
65	["PHP_SELF"]=>
66	string(12) "/w/index.php"
67	["REQUEST_TIME_FLOAT"]=>
68	float(1460584091.294)
69	["REQUEST_TIME"]=>
70	int(1460584091)
71	}

With the examples, could you be more-specific about what's broken in them?

For T123276:

…I actually don't see anything obviously wrong with it. Perhaps I was wrong about this one.

For T128380:

Bad:

["PHP_SELF"] => string(46) "/w/index.php/Why_Me%3F_(Daniel_Johnston_Album)"
["QUERY_STRING"] => string(24) "_(Daniel_Johnston_Album)"
["REQUEST_URI"] => string(39) "/wiki/Why_Me%3F_(Daniel_Johnston_Album)"
["PATH_INFO"] => string(34) "/Why_Me%3F_(Daniel_Johnston_Album)"
["PATH_TRANSLATED"] => string(82) "/srv/mediawiki/docroot/wikipedia.org/w/index.php/Why_Me%3F_(Daniel_Johnston_Album)"

Good:

["PHP_SELF"] => string(12) "/w/index.php"
["QUERY_STRING"] => string(0) ""
["REQUEST_URI"] => string(39) "/wiki/Why_Me%3F_(Daniel_Johnston_Album)"

QUERY_STRING should be missing or empty. There probably shouldn't be any PATH_INFO.

For T123276:

Bad:

["PHP_SELF"] => string(19) "/w/index.php/Bug%3F"
["QUERY_STRING"] => string(15) "?action=history"
["REQUEST_URI"] => string(27) "/wiki/Bug%3F?action=history"
["PATH_INFO"] => string(7) "/Bug%3F"
["PATH_TRANSLATED"] => string(55) "/srv/mediawiki/docroot/wikipedia.org/w/index.php/Bug%3F"

Good:

["PHP_SELF"] => string(12) "/w/index.php"
["QUERY_STRING"] => string(14) "action=history"
["REQUEST_URI"] => string(27) "/wiki/Bug%3F?action=history"

QUERY_STRING should be just "action=history" (the '?' is not part of query string). There probably shouldn't be any PATH_INFO.

PATH_INFO is fine and expected. The supposedly-bad PHP_SELF is probably also ok (at least it matches the behavior of mod_php). See also T96274.

matmarex removed a parent task: T132612: api.php gives a 302 redirect to URL with '&*' appended, breaking CORS requests.Apr 14 2016, 5:36 PM

matmarex added a parent task: Restricted Task.

fgiunchedi triaged this task as Medium priority.Apr 28 2016, 10:50 AM

matmarex mentioned this in T134248: printableversion link in toolbox does not take viewed revision into account.May 4 2016, 3:34 AM

Aklapper added a project: Traffic.May 4 2016, 9:13 AM

matmarex mentioned this in T139271: wgRedirectedFrom not populated/exposed if redirect accessed via index.php?title=Redirect_page.Jul 4 2016, 1:29 PM

Danny_B added a subtask: T139271: wgRedirectedFrom not populated/exposed if redirect accessed via index.php?title=Redirect_page.Jul 4 2016, 2:14 PM

Danny_B closed subtask T139271: wgRedirectedFrom not populated/exposed if redirect accessed via index.php?title=Redirect_page as Resolved.Jul 4 2016, 6:27 PM

BBlack moved this task from Backlog to Radar/Not for service by Traffic on the Traffic board.Oct 4 2016, 1:13 PM

elukey moved this task from Backlog to R&D needed on the Wikimedia-Apache-configuration board.Nov 16 2016, 1:22 PM

elukey moved this task from R&D needed to Testing needed on the Wikimedia-Apache-configuration board.Nov 16 2016, 9:19 PM

matmarex added a parent task: T153275: URL to pagenames with special characters fail.Dec 15 2016, 1:21 AM

Liuxinyu970226 subscribed.Dec 31 2016, 3:21 PM

matmarex mentioned this in T153275: URL to pagenames with special characters fail.Mar 8 2017, 7:01 PM

Ottomata merged a task: T153275: URL to pagenames with special characters fail.Mar 8 2017, 7:47 PM

Ottomata added subscribers: Writ_Keeper, Ottomata, Unready and 2 others.

matmarex mentioned this in T201072: [[?oldid=851713451]] is a valid link in the new preview, but not when the page is saved.Aug 2 2018, 6:55 PM

matmarex added a parent task: T201072: [[?oldid=851713451]] is a valid link in the new preview, but not when the page is saved.

• Phabricator_maintenance moved this task from Backlog to Acknowledged on the SRE board.Jan 26 2019, 8:36 PM

matmarex added a project: HHVM.Nov 12 2019, 9:12 PM

matmarex moved this task from Backlog to Defect on the HHVM board.

I can't reproduce the problems described in any of the parent tasks any more. I assume this was fixed by migrating to PHP 7 (T176370).

matmarex closed this task as Resolved.Nov 12 2019, 9:15 PM

Aklapper removed a subscriber: Anomie.Oct 16 2020, 5:42 PM

Data passed to HHVM ($_SERVER variables) is a mixed bag of already-decoded and non-decoded nonsenseClosed, ResolvedPublicActions

Description

Related ObjectsSearch...

Event Timeline

Data passed to HHVM ($_SERVER variables) is a mixed bag of already-decoded and non-decoded nonsense
Closed, ResolvedPublic
Actions

Related Objects
Search...