SOLUTION TO MY PROBLEM: Beforehand I've installed SecurityMod through the WebPI platform, but I haven't seen any options pop-up in the IIS manager. I couldn't uninstall it afterwards, because WebPI indicated as if it never installed. So, I assumed it didn't successfully install and just forgot about it.
Then I checked the Windows' error logs and saw SecurityMod had a bunch of entries. After manually uninstalling this thing, everything works as intended!
ORIGINAL PROBLEM:
I had a website on IIS 8.5 and PHP 5.3.28. Now I've upgraded to PHP 7.0.5.
All of the sudden, my $_POST
arrays are empty on pages with a POST form! The code didn't change, I've just upgraded PHP and changed a few IIS settings.
Has anyone had this issue before?
EDIT: I've just tried reverting back to 5.3.28 and noticed that instead of the aforementioned effect, the page is just loading and loading and loading... And never loading.
I'm not sure how to chase this bug. Could any IIS security settings or plugins cause this?
EDIT 2: register globals was Off in my PHP 5.3.28 ini config.
Server-side code:
<?PHP
ob_start();
require_once('conf.php');
require_once($path2root.'class/common.php'); // var defined in class/conf.php
$p = lib_GetUser(); // defined in class/common.php
print_r($_SESSION); // ok (outputs the generated id I've put in from the last request)
print_r($_POST); // empty!
print_r($_GET); // ok (outputs the id in the URL)
if (!isset($_GET['id'])) {
exit();
}
$checkOk = false;
if(isset($_SESSION['FirstKey']) && isset($_POST['key'])) {
$checkOk = $_SESSION['FirstKey'] == $_POST['key'];
// this was true on the old version!
}
[...]
Client-side:
<form name="form" method="post" action="Keytest.php?id=16336">
<input type="hidden" name="key" value="174e2f46">
<p>Hello</p>
<input type="submit" value="ok">
<input type="button" value="Back" onclick="history.go(-1);">
</form>
EDIT 3: The 5.3.28 page finally loaded to a 500 error.
69. view trace Error -FASTCGI_REQUEST_TIMEOUT
70. view trace Warning -SET_RESPONSE_ERROR_DESCRIPTION
ErrorDescription C:\Program Files (x86)\PHP\v5.3\php-cgi.exe - The FastCGI process exceeded configured request timeout
71. view trace Warning -MODULE_SET_RESPONSE_ERROR_STATUS
ModuleName FastCgiModule
Notification EXECUTE_REQUEST_HANDLER
HttpStatus 500
HttpReason Internal Server Error
HttpSubStatus 0
ErrorCode The wait operation timed out.
(0x80070102)
ConfigExceptionInfo
I figured it out. It was the default configuration of SecurityMod that was causing the problem. Interestingly, it manifested differently in PHP 5.3 vs. 7.0.
Uninstalling it did the trick.
User contributions licensed under CC BY-SA 3.0