[2008-01-28 14:30 UTC] vadim dot negoda at gmail dot com

.

 [2008-01-28 15:05 UTC] felipe@php.net

Thank you for this bug report. To properly diagnose the problem, we
need a short but complete example script to be able to reproduce
this bug ourselves. 

A proper reproducing script starts with <?php and ends with ?>,
is max. 10-20 lines long and does not require any external 
resources such as databases, etc. If the script requires a 
database to demonstrate the issue, please make sure it creates 
all necessary tables, stored procedures etc.

Please avoid embedding huge scripts into the report.

 [2008-01-28 15:25 UTC] vadim dot negoda at gmail dot com

Sorry if may message very long...
<?
@session_start();
@error_reporting(7);
@ini_set('display_errors', true);
@ini_set('html_errors', false);

define('DATALIFEENGINE', true);
define('ROOT_DIR', '../..');
define('ENGINE_DIR', '..');

include ENGINE_DIR.'/data/config.php';
require_once ENGINE_DIR.'/inc/mysql.php';
require_once ENGINE_DIR.'/data/dbconfig.php';

$_REQUEST['skin'] = end (explode (DIRECTORY_SEPARATOR, $_REQUEST['skin']));
if ($_REQUEST['skin']) {
	if (@is_dir(ROOT_DIR.'/templates/'.$_REQUEST['skin']))
	{
		$config['skin'] = $_REQUEST['skin'];
	}
	else
	{
		die ("Hacking attempt!");
	}
}

if ($config["lang_".$config['skin']]) { 

     include_once ROOT_DIR.'/language/'.$config["lang_".$config['skin']].'/website.lng';

} else {

     include_once ROOT_DIR.'/language/'.$config['langs'].'/website.lng';

}
$config['charset'] = ($lang['charset'] != '') ? $lang['charset'] : $config['charset'];

require_once ENGINE_DIR.'/modules/functions.php';
require_once ENGINE_DIR.'/modules/sitelogin.php';

$go_rate = intval($_REQUEST['go_rate']);
$news_id = intval($_REQUEST['news_id']);

if ($go_rate > 5 OR $go_rate <  1) $go_rate = 0;
if (!$go_rate OR !$news_id) die ("error");

$_IP = $db->safesql($_SERVER['REMOTE_ADDR']);

if ($is_logged) $where = "member = '{$member_id['name']}'";
else $where = "ip ='{$_IP}'";

@header("HTTP/1.0 200 OK");
@header("HTTP/1.1 200 OK");
@header("Cache-Control: no-cache, must-revalidate, max-age=0");
@header("Expires: 0");
@header("Pragma: no-cache");
@header("Content-type: text/css; charset=".$config['charset']);
echo $buffer;
?>

 [2008-01-28 15:59 UTC] scottmac@php.net

If you try to set the same status code twice, you'll see this leak. I have a patch that I'll apply later today.

 [2008-01-28 16:09 UTC] vadim dot negoda at gmail dot com

I had success changing a line:
//@header("HTTP/1.0 200 OK");

 [2008-01-28 16:13 UTC] scottmac@php.net

This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.