Received: (qmail 15610 invoked by uid 65534); 1 Feb 2000 15:23:16 -0000
Message-Id: <20000201152316.15609.qmail@locus.apache.org>
Date: 1 Feb 2000 15:23:16 -0000
From: Chris Hardie <chris@summersault.com>
Reply-To: chris@summersault.com
To: submit@bugz.apache.org
Subject: SetEnv directive has no effect
X-Send-Pr-Version: 3.110

>Number:         5680
>Category:       mod_env
>Synopsis:       SetEnv directive has no effect
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    apache
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   apache
>Arrival-Date:   Tue Feb 01 07:30:00 PST 2000
>Closed-Date:    Sun Sep 17 20:08:49 PDT 2000
>Last-Modified:  Sun Sep 17 20:08:49 PDT 2000
>Originator:     chris@summersault.com
>Release:        1.3.11
>Organization:
>Environment:
FreeBSD nollie.summersault.com 3.3-RELEASE FreeBSD 3.3-RELEASE #0:
Apache 1.3.11 with suEXEC
>Description:
In trying to pass environment variables to CGI scripts, I've used various 
configurations of the SetEnv directive.  None have worked; the environment variable is
never populated in the CGI script's environment.  Standard environment variables
(e.g. SCRIPT_NAME, REMOTE_USER, etc) work fine.

I've verified that mod_env is compiled into the running server.
I've verified that the variables I'm setting are not being set anywhere
else.
I've tried moving the SetEnv calls outside of the Virtual Host entry and
into the main server config - didn't work.

Someone on a mailing list indicated that the *position* of the
directives in the Virtual Host entry mattered for his setup.  I've moved
them around and had no luck.

I modified (gasp!) suexec.c, specifically the "safe_env_lst[]" variable to
include the two ENV variables I want.  I recompiled the server, restarted
it, and it still doesn't work.

I suspect suEXEC plays into this somehow, but I've followed the docs and don't 
quite know what else to do.

I've posted a message to the mailing list asking for help several days ago, 
got no answer.

>How-To-Repeat:
httpd.conf snippet:

<VirtualHost 208.247.89.234>
ServerAdmin webmaster@summersault.com
DocumentRoot /home/hotzp/www
ServerName www.hotzp.com
ErrorLog /home/hotzp/logs/httpd-error_log
TransferLog /home/hotzp/logs/httpd-access_log
<Directory /home/hotzp/www/cgi-bin>
Options ExecCGI
</Directory>
ScriptAlias /cgi-bin/ /home/hotzp/www/cgi-bin/
SetEnv QMAILSUSER silas
SetEnv QMAILSHOST hotzp.com
User hotzp
Group hotzp
</VirtualHost>
>Fix:
I really don't - I'm sorry.
>Release-Note:
>Audit-Trail:
State-Changed-From-To: open-closed
State-Changed-By: slive
State-Changed-When: Sun Sep 17 20:08:49 PDT 2000
State-Changed-Why:
suexec cleans the environment down to a 
small set of "safe" variables for security
reasons.  If you are using suexec,
you cann't pass arbitrary env variables
to CGI scripts.
Thanks for using Apache.
>Unformatted:
 [In order for any reply to be added to the PR database, you need]
 [to include <apbugs@Apache.Org> in the Cc line and make sure the]
 [subject line starts with the report component and number, with ]
 [or without any 'Re:' prefixes (such as "general/1098:" or      ]
 ["Re: general/1098:").  If the subject doesn't match this       ]
 [pattern, your message will be misfiled and ignored.  The       ]
 ["apbugs" address is not added to the Cc line of messages from  ]
 [the database automatically because of the potential for mail   ]
 [loops.  If you do not include this Cc, your reply may be ig-   ]
 [nored unless you are responding to an explicit request from a  ]
 [developer.  Reply only with text; DO NOT SEND ATTACHMENTS!     ]