$_POST is empty upon PHP upgrade

1

SOLUTION TO MY PROBLEM: Beforehand I've installed SecurityMod through the WebPI platform, but I haven't seen any options pop-up in the IIS manager. I couldn't uninstall it afterwards, because WebPI indicated as if it never installed. So, I assumed it didn't successfully install and just forgot about it.

Then I checked the Windows' error logs and saw SecurityMod had a bunch of entries. After manually uninstalling this thing, everything works as intended!

ORIGINAL PROBLEM:

I had a website on IIS 8.5 and PHP 5.3.28. Now I've upgraded to PHP 7.0.5.

All of the sudden, my $_POST arrays are empty on pages with a POST form! The code didn't change, I've just upgraded PHP and changed a few IIS settings.

Has anyone had this issue before?

EDIT: I've just tried reverting back to 5.3.28 and noticed that instead of the aforementioned effect, the page is just loading and loading and loading... And never loading.

I'm not sure how to chase this bug. Could any IIS security settings or plugins cause this?

EDIT 2: register globals was Off in my PHP 5.3.28 ini config.

Server-side code:

<?PHP
ob_start(); 

require_once('conf.php');
require_once($path2root.'class/common.php'); // var defined in class/conf.php

$p = lib_GetUser(); // defined in class/common.php

print_r($_SESSION); // ok (outputs the generated id I've put in from the last request)
print_r($_POST); // empty!
print_r($_GET); // ok (outputs the id in the URL)

if (!isset($_GET['id'])) {
  exit();
}

$checkOk = false;
if(isset($_SESSION['FirstKey']) && isset($_POST['key'])) {
  $checkOk = $_SESSION['FirstKey'] == $_POST['key'];
  // this was true on the old version!
}

[...]

Client-side:

<form name="form" method="post" action="Keytest.php?id=16336">
  <input type="hidden" name="key" value="174e2f46">
  <p>Hello</p>
  <input type="submit" value="ok">
  <input type="button" value="Back" onclick="history.go(-1);">
</form>

EDIT 3: The 5.3.28 page finally loaded to a 500 error.

69. view trace  Error   -FASTCGI_REQUEST_TIMEOUT

70. view trace  Warning -SET_RESPONSE_ERROR_DESCRIPTION
ErrorDescription    C:\Program Files (x86)\PHP\v5.3\php-cgi.exe - The FastCGI process exceeded configured request timeout

71. view trace  Warning -MODULE_SET_RESPONSE_ERROR_STATUS
ModuleName  FastCgiModule
Notification    EXECUTE_REQUEST_HANDLER
HttpStatus  500
HttpReason  Internal Server Error
HttpSubStatus   0
ErrorCode   The wait operation timed out.
 (0x80070102)
ConfigExceptionInfo 
php
iis
asked on Stack Overflow May 20, 2016 by Howie • edited May 21, 2016 by Howie

1 Answer

0

I figured it out. It was the default configuration of SecurityMod that was causing the problem. Interestingly, it manifested differently in PHP 5.3 vs. 7.0.

Uninstalling it did the trick.

answered on Stack Overflow May 22, 2016 by Howie

User contributions licensed under CC BY-SA 3.0