Jaromir Dolecek wrote:
> According to:
> 
> http://www.php.net/manual/en/security.cgi-bin.shell.php
> 
> it appears such setup would not work, PATH_INFO and PATH_TRANSLATED
> would contain incorrect info.

 From the sapi/cgi/README.FastCGI file included with the PHP sources:

     You must add '--enable-fastcgi' to the configure command on Linux or
     OSX based systems to get fastcgi support in the php-cgi binary.  You
     also must not use '--enable-discard-path'.

My original goal was simply to provide a FastCGI-capable PHP 
installation by default.  I had suggested getting rid of 
--enable-discard-path for only this reason, but I freely admit that I 
didn't understand the ramifications of this.

Since it's clear that there are some trade-offs that have to be made 
depending on whether you decide to run PHP as a CGI or with FastCGI (in 
particular, the --enable-discard-path option), perhaps we could provide 
php-fastcgi packages instead?  I would normally just use a PKG_OPTION 
for something like this, but I think that having the bulk builds 
automatically build and provide binary packages for a PHP package that 
does FastCGI is desirable enough to warrant a separate package.

My new plan is to create a php-fastcgi package that only installs:

	${PREFIX}/libexec/cgi-bin/php-fcgi
	${PREFIX}/share/doc/php[45]/README.FastCGI

The php-fastcgi package would be configured *with* 
--enable-force-cgi-redirect but *without* --enable-discard-path.
This package would depend on the corresponding php package to get all 
the standard modules and PEAR installation.  Does this sound workable to 
you?

	Cheers,

	-- Johnny Lam <jlam@NetBSD.org>