hmmmm.
Script connecting to Oracle database worked fine in MSIE but fails in Firefox and Chrome.
On further investigation we discovered that the problem was due to PHP failing to open the tnsnames.ora file (this tells Oracle clients where on the network and what protocol to use when connecting to the database given in ora_logon / oci_connect).
Let's be quite clear here:
- when the request originated from MSIE, IIS had permissions to open the file
- when the request originated from any other browser, IIS did not have permission to open the file
In both cases, the script executes as the same user on IIS. Using a user-agent switcher on Firefox had no impact.
There is an additional complication that the file in question sat on a network share, but that should have no bearing on how IIS behaves. However using a local copy of the file works as expected.
Micorosft IIS's security model is working differently depending on the browser used - this is potentially a security vulnerability in IIS.
Again, Microsoft IIS is giving different and preferential treatment to MSIE browsers
No comments:
Post a Comment