Skip to content

Instantly share code, notes, and snippets.

@alexpott

alexpott/httpoxy.php Secret

Last active July 19, 2016 14:52
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save alexpott/c3903713ac888b069b915975162dc718 to your computer and use it in GitHub Desktop.
Save alexpott/c3903713ac888b069b915975162dc718 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
httpoxy.php
<?php
// Run this script with command:
// curl -H 'Proxy: AFFECTED' http://localhost/httpoxy.php
putenv("HTTP_PROXY="); $_SERVER['HTTP_PROXY'] = "";
print "Env:" . getenv('HTTP_PROXY') . "\n"; // Amazingly this is still AFFECTED
print "Server:" . $_SERVER['HTTP_PROXY']; // This is the expected empty string
@DavidRothstein
Copy link

Try putting apache_setenv('HTTP_PROXY', ''); at the end of the first line... then it seems to work correctly (at least on mod_php).

(I think that's what https://access.redhat.com/solutions/2442861 meant to suggest, but the example there uses "apache_putenv" instead...)

@DavidRothstein
Copy link

The Red Hat example (linked above) has since been updated to use "apache_setenv" also. Still not clear if their example actually works under CGI though.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment