I don't get it, so if I use CGI, and from my code, I query the env variable named 'HTTP_PROXY' , I will get what was set by the request header PROXY and not an environment variable 'HTTP_PROXY' as defined by the system the cgi executable is running on ?
edit :
I looked at CGI
https://en.wikipedia.org/wiki/Common_Gateway_Interface
I don't understand why this protocol just doesn't pass informations as an argument for the cgi script, why does it have to use environment variables ?
> pass informations as an argument for the cgi script
Elaborate?
1.6.3 will include https://github.com/golang/go/commit/fad2bbdc6a686a20174d2e73... in addition to the security fix.
Yeah it's plan9 assembly which is its own thing (just as plan9 "C" was its own thing): http://plan9.bell-labs.com/sys/doc/asm.html
You see this too with AT&T syntax, sometimes.
.highlight .sb {
color: #ec490f; }
.highlight .sc {
color: #ec490f; }
.highlight .sd {
color: #ec490f; }
.highlight .s2 {
color: #ec490f; }
.highlight .se {
color: #ec490f; }
.highlight .sh {
color: #ec490f; }http://www.nntp.perl.org/group/perl.libwww/2001/03/msg2249.h...
I've deployed a few large apps using Phusion Passenger, that years later are still running with incredible stability. Thank you!
Moreover, curl has http_proxy, but also HTTPS_PROXY, FTP_PROXY, ..._PROXY, ALL_PROXY and NO_PROXY.
From our testing, we could get getenv in mod_php to return HTTP_PROXY when you ask for getenv('http_proxy') (seems to happen in the apr stuff?) - but that didn't affect PHP's libcurl extension, which made it a whole lot less interesting.
But yeah, if you're running curl itself under CGI with case-insensitive env vars you might still be in trouble.
If you start a new process, always be explicit about the environment variables you want to pass on. Don't just let the subprocess inherit your environment variables.
If you write a library, do not rely on environment variables unless the user of the library has explicitly opted-in to that.
(To be fair, this was probably a low-level support engineer, so probably not that "official" of a response)
This issue is pretty bad though.