some input filter support

5 files changed, 143 insertions, 166 deletions

diff --git a/config.m4 b/config.m4
index 6cb35cf..8f6d645 100644
--- a/config.m4
+++ b/config.m4
@@ -5,7 +5,7 @@ PHP_ARG_ENABLE(suhosin, whether to enable suhosin support,
 [  --enable-suhosin        Enable suhosin support])
 
 if test "$PHP_SUHOSIN" != "no"; then
-  PHP_NEW_EXTENSION(suhosin7, suhosin7.c aes.c ifilter.c memory_limit.c sha256.c treat_data.c log.c, $ext_shared,, -DZEND_ENABLE_STATIC_TSRMLS_CACHE=1)
+  PHP_NEW_EXTENSION(suhosin7, suhosin7.c aes.c ifilter.c memory_limit.c sha256.c treat_data.c log.c execute.c, $ext_shared,, -DZEND_ENABLE_STATIC_TSRMLS_CACHE=1)
 fi
 
 PHP_ARG_ENABLE(suhosin7-experimental, whether to enable experimental suhosin7 features,
diff --git a/ifilter.c b/ifilter.c
index 627fdbd..c75abe8 100644
--- a/ifilter.c
+++ b/ifilter.c
@@ -3,7 +3,7 @@
   | Suhosin Version 1                                                    |
   +----------------------------------------------------------------------+
   | Copyright (c) 2006-2007 The Hardened-PHP Project                     |
-  | Copyright (c) 2007-2015 SektionEins GmbH                             |
+  | Copyright (c) 2007-2016 SektionEins GmbH                             |
   +----------------------------------------------------------------------+
   | This source file is subject to version 3.01 of the PHP license,      |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -13,7 +13,8 @@
   | obtain it through the world-wide-web, please send a note to          |
   | license@php.net so we can mail you a copy immediately.               |
   +----------------------------------------------------------------------+
-  | Author: Stefan Esser <sesser@sektioneins.de>                         |
+  | Authors: Stefan Esser <sesser@sektioneins.de>                        |
+  |          Ben Fuhrmannek <ben.fuhrmannek@sektioneins.de>              |
   +----------------------------------------------------------------------+
 */
 /*
@@ -156,6 +157,7 @@ static void suhosin_server_strip(HashTable *arr, char *key, int klen)
         }
                 
         t = (unsigned char *)Z_STRVAL_P(zv);
+        // SDEBUG()
         for (; *t; t++) {
                 if (suhosin_is_dangerous_char[*t]) {
                         *t = '?';
@@ -205,7 +207,10 @@ static void suhosin_server_encode(HashTable *arr, char *key, int klen)
         *n = 0;
 
         zend_string *zs = zend_string_extend(Z_STR_P(zv), dest_len, 0);
-        memcpy(Z_STR_P(zv), dest, dest_len);
+        memcpy(ZSTR_VAL(zs), dest, dest_len);
+        ZSTR_LEN(zs) = dest_len-1;
+        zend_string_forget_hash_val(zs);
+        Z_STR_P(zv) = zs;
 }
 /* }}} */
 
@@ -287,17 +292,20 @@ unsigned int (*old_input_filter)(int arg, char *var, char **val, size_t val_len,
  */
 unsigned int suhosin_input_filter_wrapper(int arg, char *var, char **val, size_t val_len, size_t *new_val_len)
 {
-        zend_bool already_scanned = SUHOSIN7_G(already_scanned);
-        SUHOSIN7_G(already_scanned) = 0;
+        // zend_bool already_scanned = SUHOSIN7_G(already_scanned);
+        // SUHOSIN7_G(already_scanned) = 0;
+        // SDEBUG("ifilter arg=%d var=%s do_not_scan=%d already_scanned=%d", arg, var, SUHOSIN7_G(do_not_scan), already_scanned);
+        SDEBUG("ifilter arg=%d var=%s do_not_scan=%d", arg, var, SUHOSIN7_G(do_not_scan));
         
         if (SUHOSIN7_G(do_not_scan)) {
+                SDEBUG("do_not_scan");
                 if (new_val_len) {
                         *new_val_len = val_len;
                 }
                 return 1;
         }
         
-        if (!already_scanned) {
+        // if (!already_scanned) {
                 if (suhosin_input_filter(arg, var, val, val_len, new_val_len)==0) {
                         SUHOSIN7_G(abort_request)=1;
                         return 0;
@@ -305,7 +313,7 @@ unsigned int suhosin_input_filter_wrapper(int arg, char *var, char **val, size_t
                 if (new_val_len) {
                         val_len = *new_val_len;
                 }
-        }
+        // }
         if (old_input_filter) {
                 return old_input_filter(arg, var, val, val_len, new_val_len);
         } else {
@@ -317,11 +325,12 @@ unsigned int suhosin_input_filter_wrapper(int arg, char *var, char **val, size_t
  */
 unsigned int suhosin_input_filter(int arg, char *var, char **val, size_t val_len, size_t *new_val_len)
 {
+        SDEBUG("%s=%s arg=%d", var, *val, arg);
         char *index, *prev_index = NULL;
         unsigned int var_len, total_len, depth = 0;
 
         /* Mark that we were called */
-        SUHOSIN7_G(already_scanned) = 1;
+        // SUHOSIN7_G(already_scanned) = 1;
 
         if (new_val_len) {
                 *new_val_len = 0;
@@ -363,7 +372,7 @@ unsigned int suhosin_input_filter(int arg, char *var, char **val, size_t val_len
                         if (SUHOSIN7_G(max_get_vars) && SUHOSIN7_G(max_get_vars) <= SUHOSIN7_G(cur_get_vars)) {
                                 suhosin_log(S_VARS, "configured GET variable limit exceeded - dropped variable '%s' - all further GET variables are dropped", var);
                                 if (!SUHOSIN7_G(simulation)) {
-                                                                        SUHOSIN7_G(no_more_get_variables) = 1;
+                                        SUHOSIN7_G(no_more_get_variables) = 1;
                                         return 0;
                                 }
                         }
@@ -372,7 +381,7 @@ unsigned int suhosin_input_filter(int arg, char *var, char **val, size_t val_len
                         if (SUHOSIN7_G(max_cookie_vars) && SUHOSIN7_G(max_cookie_vars) <= SUHOSIN7_G(cur_cookie_vars)) {
                                 suhosin_log(S_VARS, "configured COOKIE variable limit exceeded - dropped variable '%s' - all further COOKIE variables are dropped", var);
                                 if (!SUHOSIN7_G(simulation)) {
-                                                                        SUHOSIN7_G(no_more_cookie_variables) = 1;
+                                        SUHOSIN7_G(no_more_cookie_variables) = 1;
                                         return 0;
                                 }
                         }
@@ -389,71 +398,58 @@ unsigned int suhosin_input_filter(int arg, char *var, char **val, size_t val_len
         }
         
         /* Drop this variable if it begins with whitespace which is disallowed */
+        // SDEBUG("checking '%c'", *var);
         if (isspace(*var)) {
+                SDEBUG("is WS");
                 if (SUHOSIN7_G(disallow_ws)) {
                         suhosin_log(S_VARS, "request variable name begins with disallowed whitespace - dropped variable '%s'", var);
-                        if (!SUHOSIN7_G(simulation)) {
-                                return 0;
-                        }
+                        if (!SUHOSIN7_G(simulation)) { return 0; }
                 }
                 switch (arg) {
                         case PARSE_GET:
                                 if (SUHOSIN7_G(disallow_get_ws)) {
                                         suhosin_log(S_VARS, "GET variable name begins with disallowed whitespace - dropped variable '%s'", var);
-                                        if (!SUHOSIN7_G(simulation)) {
-                                                return 0;
-                                        }
+                                        if (!SUHOSIN7_G(simulation)) { return 0; }
                                 }
                                 break;
                         case PARSE_POST:
                                 if (SUHOSIN7_G(disallow_post_ws)) {
                                         suhosin_log(S_VARS, "POST variable name begins with disallowed whitespace - dropped variable '%s'", var);
-                                        if (!SUHOSIN7_G(simulation)) {
-                                                return 0;
-                                        }
+                                        if (!SUHOSIN7_G(simulation)) { return 0; }
                                 }
                                 break;
                         case PARSE_COOKIE:
                                 if (SUHOSIN7_G(disallow_cookie_ws)) {
                                         suhosin_log(S_VARS, "COOKIE variable name begins with disallowed whitespace - dropped variable '%s'", var);
-                                        if (!SUHOSIN7_G(simulation)) {
-                                                return 0;
-                                        }
+                                        if (!SUHOSIN7_G(simulation)) { return 0; }
                                 }
                                 break;
                 }
         }
+        // else { SDEBUG("not WS");}
         
         /* Drop this variable if it exceeds the value length limit */
         if (SUHOSIN7_G(max_value_length) && SUHOSIN7_G(max_value_length) < val_len) {
                 suhosin_log(S_VARS, "configured request variable value length limit exceeded - dropped variable '%s'", var);
-                if (!SUHOSIN7_G(simulation)) {
-                        return 0;
-                }
+                if (!SUHOSIN7_G(simulation)) { return 0; }
         }
         switch (arg) {
                 case PARSE_GET:
                         if (SUHOSIN7_G(max_get_value_length) && SUHOSIN7_G(max_get_value_length) < val_len) {
                                 suhosin_log(S_VARS, "configured GET variable value length limit exceeded - dropped variable '%s'", var);
-                                if (!SUHOSIN7_G(simulation)) {
-                                        return 0;
-                                }
+                                if (!SUHOSIN7_G(simulation)) { return 0; }
                         }
                         break;
                 case PARSE_COOKIE:
                         if (SUHOSIN7_G(max_cookie_value_length) && SUHOSIN7_G(max_cookie_value_length) < val_len) {
                                 suhosin_log(S_VARS, "configured COOKIE variable value length limit exceeded - dropped variable '%s'", var);
-                                if (!SUHOSIN7_G(simulation)) {
-                                        return 0;
-                                }
+                                if (!SUHOSIN7_G(simulation)) { return 0; }
                         }
                         break;
                 case PARSE_POST:
                         if (SUHOSIN7_G(max_post_value_length) && SUHOSIN7_G(max_post_value_length) < val_len) {
                                 suhosin_log(S_VARS, "configured POST variable value length limit exceeded - dropped variable '%s'", var);
-                                if (!SUHOSIN7_G(simulation)) {
-                                        return 0;
-                                }
+                                if (!SUHOSIN7_G(simulation)) { return 0; }
                         }
                         break;
         }
@@ -469,57 +465,41 @@ unsigned int suhosin_input_filter(int arg, char *var, char **val, size_t val_len
         /* Drop this variable if it exceeds the varname/total length limit */
         if (SUHOSIN7_G(max_varname_length) && SUHOSIN7_G(max_varname_length) < var_len) {
                 suhosin_log(S_VARS, "configured request variable name length limit exceeded - dropped variable '%s'", var);
-                if (!SUHOSIN7_G(simulation)) {
-                        return 0;
-                }
+                if (!SUHOSIN7_G(simulation)) { return 0; }
         }
         if (SUHOSIN7_G(max_totalname_length) && SUHOSIN7_G(max_totalname_length) < total_len) {
                 suhosin_log(S_VARS, "configured request variable total name length limit exceeded - dropped variable '%s'", var);
-                if (!SUHOSIN7_G(simulation)) {
-                        return 0;
-                }
+                if (!SUHOSIN7_G(simulation)) { return 0; }
         }
         switch (arg) {
                 case PARSE_GET:
                         if (SUHOSIN7_G(max_get_name_length) && SUHOSIN7_G(max_get_name_length) < var_len) {
                                 suhosin_log(S_VARS, "configured GET variable name length limit exceeded - dropped variable '%s'", var);
-                                if (!SUHOSIN7_G(simulation)) {
-                                        return 0;
-                                }
+                                if (!SUHOSIN7_G(simulation)) { return 0; }
                         }
                         if (SUHOSIN7_G(max_get_totalname_length) && SUHOSIN7_G(max_get_totalname_length) < total_len) {
                                 suhosin_log(S_VARS, "configured GET variable total name length limit exceeded - dropped variable '%s'", var);
-                                if (!SUHOSIN7_G(simulation)) {
-                                        return 0;
-                                }
+                                if (!SUHOSIN7_G(simulation)) { return 0; }
                         }
                         break;
                 case PARSE_COOKIE:
                         if (SUHOSIN7_G(max_cookie_name_length) && SUHOSIN7_G(max_cookie_name_length) < var_len) {
                                 suhosin_log(S_VARS, "configured COOKIE variable name length limit exceeded - dropped variable '%s'", var);
-                                if (!SUHOSIN7_G(simulation)) {
-                                        return 0;
-                                }
+                                if (!SUHOSIN7_G(simulation)) { return 0; }
                         }
                         if (SUHOSIN7_G(max_cookie_totalname_length) && SUHOSIN7_G(max_cookie_totalname_length) < total_len) {
                                 suhosin_log(S_VARS, "configured COOKIE variable total name length limit exceeded - dropped variable '%s'", var);
-                                if (!SUHOSIN7_G(simulation)) {
-                                        return 0;
-                                }
+                                if (!SUHOSIN7_G(simulation)) { return 0; }
                         }
                         break;
                 case PARSE_POST:
                         if (SUHOSIN7_G(max_post_name_length) && SUHOSIN7_G(max_post_name_length) < var_len) {
                                 suhosin_log(S_VARS, "configured POST variable name length limit exceeded - dropped variable '%s'", var);
-                                if (!SUHOSIN7_G(simulation)) {
-                                        return 0;
-                                }
+                                if (!SUHOSIN7_G(simulation)) { return 0; }
                         }
                         if (SUHOSIN7_G(max_post_totalname_length) && SUHOSIN7_G(max_post_totalname_length) < total_len) {
                                 suhosin_log(S_VARS, "configured POST variable total name length limit exceeded - dropped variable '%s'", var);
-                                if (!SUHOSIN7_G(simulation)) {
-                                        return 0;
-                                }
+                                if (!SUHOSIN7_G(simulation)) { return 0; }
                         }
                         break;
         }
@@ -545,33 +525,25 @@ unsigned int suhosin_input_filter(int arg, char *var, char **val, size_t val_len
                 /* max. array index length */
                 if (SUHOSIN7_G(max_array_index_length) && SUHOSIN7_G(max_array_index_length) < index_length) {
                         suhosin_log(S_VARS, "configured request variable array index length limit exceeded - dropped variable '%s'", var);
-                        if (!SUHOSIN7_G(simulation)) {
-                                return 0;
-                        }
+                        if (!SUHOSIN7_G(simulation)) { return 0; }
                 } 
                 switch (arg) {
                         case PARSE_GET:
                                 if (SUHOSIN7_G(max_get_array_index_length) && SUHOSIN7_G(max_get_array_index_length) < index_length) {
                                         suhosin_log(S_VARS, "configured GET variable array index length limit exceeded - dropped variable '%s'", var);
-                                        if (!SUHOSIN7_G(simulation)) {
-                                                return 0;
-                                        }
+                                        if (!SUHOSIN7_G(simulation)) { return 0; }
                                 } 
                                 break;
                         case PARSE_COOKIE:
                                 if (SUHOSIN7_G(max_cookie_array_index_length) && SUHOSIN7_G(max_cookie_array_index_length) < index_length) {
                                         suhosin_log(S_VARS, "configured COOKIE variable array index length limit exceeded - dropped variable '%s'", var);
-                                        if (!SUHOSIN7_G(simulation)) {
-                                                return 0;
-                                        }
+                                        if (!SUHOSIN7_G(simulation)) { return 0; }
                                 } 
                                 break;
                         case PARSE_POST:
                                 if (SUHOSIN7_G(max_post_array_index_length) && SUHOSIN7_G(max_post_array_index_length) < index_length) {
                                         suhosin_log(S_VARS, "configured POST variable array index length limit exceeded - dropped variable '%s'", var);
-                                        if (!SUHOSIN7_G(simulation)) {
-                                                return 0;
-                                        }
+                                        if (!SUHOSIN7_G(simulation)) { return 0; }
                                 } 
                                 break;
                 }
@@ -580,16 +552,12 @@ unsigned int suhosin_input_filter(int arg, char *var, char **val, size_t val_len
                 if (SUHOSIN7_G(array_index_whitelist) && *(SUHOSIN7_G(array_index_whitelist))) {
                         if (suhosin_strnspn(index, index_length, SUHOSIN7_G(array_index_whitelist)) != index_length) {
                                 suhosin_log(S_VARS, "array index contains not whitelisted characters - dropped variable '%s'", var);
-                                if (!SUHOSIN7_G(simulation)) {
-                                        return 0;
-                                }
+                                if (!SUHOSIN7_G(simulation)) { return 0; }
                         }
                 } else if (SUHOSIN7_G(array_index_blacklist) && *(SUHOSIN7_G(array_index_blacklist))) {
                         if (suhosin_strncspn(index, index_length, SUHOSIN7_G(array_index_blacklist)) != index_length) {
                                 suhosin_log(S_VARS, "array index contains blacklisted characters - dropped variable '%s'", var);
-                                if (!SUHOSIN7_G(simulation)) {
-                                        return 0;
-                                }
+                                if (!SUHOSIN7_G(simulation)) { return 0; }
                         }
                 }
                 
@@ -599,33 +567,25 @@ unsigned int suhosin_input_filter(int arg, char *var, char **val, size_t val_len
         /* Drop this variable if it exceeds the array depth limit */
         if (SUHOSIN7_G(max_array_depth) && SUHOSIN7_G(max_array_depth) < depth) {
                 suhosin_log(S_VARS, "configured request variable array depth limit exceeded - dropped variable '%s'", var);
-                if (!SUHOSIN7_G(simulation)) {
-                        return 0;
-                }
+                if (!SUHOSIN7_G(simulation)) { return 0; }
         }
         switch (arg) {
                 case PARSE_GET:
                         if (SUHOSIN7_G(max_get_array_depth) && SUHOSIN7_G(max_get_array_depth) < depth) {
                                 suhosin_log(S_VARS, "configured GET variable array depth limit exceeded - dropped variable '%s'", var);
-                                if (!SUHOSIN7_G(simulation)) {
-                                        return 0;
-                                }
+                                if (!SUHOSIN7_G(simulation)) { return 0; }
                         }
                         break;
                 case PARSE_COOKIE:
                         if (SUHOSIN7_G(max_cookie_array_depth) && SUHOSIN7_G(max_cookie_array_depth) < depth) {
                                 suhosin_log(S_VARS, "configured COOKIE variable array depth limit exceeded - dropped variable '%s'", var);
-                                if (!SUHOSIN7_G(simulation)) {
-                                        return 0;
-                                }
+                                if (!SUHOSIN7_G(simulation)) { return 0; }
                         }
                         break;
                 case PARSE_POST:
                         if (SUHOSIN7_G(max_post_array_depth) && SUHOSIN7_G(max_post_array_depth) < depth) {
                                 suhosin_log(S_VARS, "configured POST variable array depth limit exceeded - dropped variable '%s'", var);
-                                if (!SUHOSIN7_G(simulation)) {
-                                        return 0;
-                                }
+                                if (!SUHOSIN7_G(simulation)) { return 0; }
                         }
                         break;
         }
@@ -636,33 +596,25 @@ unsigned int suhosin_input_filter(int arg, char *var, char **val, size_t val_len
         
                 if (SUHOSIN7_G(disallow_nul)) {
                         suhosin_log(S_VARS, "ASCII-NUL chars not allowed within request variables - dropped variable '%s'", var);
-                        if (!SUHOSIN7_G(simulation)) {
-                                return 0;
-                        }
+                        if (!SUHOSIN7_G(simulation)) { return 0; }
                 }
                 switch (arg) {
                         case PARSE_GET:
                                 if (SUHOSIN7_G(disallow_get_nul)) {
                                         suhosin_log(S_VARS, "ASCII-NUL chars not allowed within GET variables - dropped variable '%s'", var);
-                                        if (!SUHOSIN7_G(simulation)) {
-                                                return 0;
-                                        }
+                                        if (!SUHOSIN7_G(simulation)) { return 0; }
                                 }
                                 break;
                         case PARSE_COOKIE:
                                 if (SUHOSIN7_G(disallow_cookie_nul)) {
                                         suhosin_log(S_VARS, "ASCII-NUL chars not allowed within COOKIE variables - dropped variable '%s'", var);
-                                        if (!SUHOSIN7_G(simulation)) {
-                                                return 0;
-                                        }
+                                        if (!SUHOSIN7_G(simulation)) { return 0; }
                                 }
                                 break;
                         case PARSE_POST:
                                 if (SUHOSIN7_G(disallow_post_nul)) {
                                         suhosin_log(S_VARS, "ASCII-NUL chars not allowed within POST variables - dropped variable '%s'", var);
-                                        if (!SUHOSIN7_G(simulation)) {
-                                                return 0;
-                                        }
+                                        if (!SUHOSIN7_G(simulation)) { return 0; }
                                 }
                                 break;
                 }
@@ -672,9 +624,7 @@ unsigned int suhosin_input_filter(int arg, char *var, char **val, size_t val_len
         /* This is to protect several silly scripts that do globalizing themself */
         if (suhosin_is_protected_varname(var, var_len)) {
                 suhosin_log(S_VARS, "tried to register forbidden variable '%s' through %s variables", var, arg == PARSE_GET ? "GET" : arg == PARSE_POST ? "POST" : "COOKIE");
-                if (!SUHOSIN7_G(simulation)) {
-                        return 0;
-                }
+                if (!SUHOSIN7_G(simulation)) { return 0; }
         }
 
         /* Okay let PHP register this variable */
diff --git a/php_suhosin7.h b/php_suhosin7.h
index 9867759..8c10df9 100644
--- a/php_suhosin7.h
+++ b/php_suhosin7.h
@@ -51,8 +51,10 @@ extern zend_module_entry suhosin7_module_entry;
 #else
 
 #ifdef SUHOSIN7_DEBUG
+// #define SDEBUG(msg...) \
+        // {FILE *f;f=fopen(SUHOSIN_LOG, "a+");if(f){fprintf(f,"[%u] ",getpid());fprintf(f, msg);fprintf(f,"\n");fclose(f);}}
 #define SDEBUG(msg...) \
-        {FILE *f;f=fopen(SUHOSIN_LOG, "a+");if(f){fprintf(f,"[%u] ",getpid());fprintf(f, msg);fprintf(f,"\n");fclose(f);}}
+        {FILE *f;f=fopen(SUHOSIN_LOG, "a+");if(f){fprintf(f,"[%u] %s:%u %s #> ",getpid(), __FILE__, __LINE__, __func__);fprintf(f, msg);fprintf(f,"\n");fclose(f);}}
 #else
 #define SDEBUG(msg...)
 #endif    
@@ -131,13 +133,16 @@ ZEND_BEGIN_MODULE_GLOBALS(suhosin7)
         // zend_bool stealth;
         zend_bool       already_scanned;
         zend_bool       abort_request;
-        // char *filter_action;
-        // 
         // 
+        
+        /* executor */
+        zend_ulong in_code_type;
         // zend_bool executor_allow_symlink;
-        // long max_execution_depth;
-        // long executor_include_max_traversal;
-        // zend_bool executor_include_allow_writable_files;
+        long execution_depth;
+        long max_execution_depth;
+        long executor_include_max_traversal;
+        zend_bool executor_include_allow_writable_files;
+        // char *filter_action;
 
 
         HashTable *include_whitelist;
@@ -148,8 +153,8 @@ ZEND_BEGIN_MODULE_GLOBALS(suhosin7)
         HashTable *eval_whitelist;
         HashTable *eval_blacklist;
 
-        // zend_bool executor_disable_eval;
-        // zend_bool executor_disable_emod;
+        zend_bool executor_disable_eval;
+        zend_bool executor_disable_emod;
 
 
 /*      request variables */
@@ -365,10 +370,22 @@ ZEND_EXTERN_MODULE_GLOBALS(suhosin7)
 
 unsigned int suhosin_input_filter(int arg, char *var, char **val, size_t val_len, size_t *new_val_len);
 unsigned int suhosin_input_filter_wrapper(int arg, char *var, char **val, size_t val_len, size_t *new_val_len);
-void suhosin_log(int loglevel, char *fmt, ...);
+PHP_SUHOSIN7_API void suhosin_log(int loglevel, char *fmt, ...);
 extern unsigned int (*old_input_filter)(int arg, char *var, char **val, size_t val_len, size_t *new_val_len);
 char *suhosin_getenv(char *name, size_t name_len);
 
+void suhosin_hook_memory_limit();
+void suhosin_hook_treat_data();
+void suhosin_hook_execute();
+void suhosin_hook_register_server_variables();
+
+static inline void suhosin_bailout(TSRMLS_D)
+{
+        if (!SUHOSIN7_G(simulation)) {
+                zend_bailout();
+        }
+}
+
 
 #endif  /* PHP_SUHOSIN7_H */
 
diff --git a/suhosin7.c b/suhosin7.c
index 872e431..b2484a3 100644
--- a/suhosin7.c
+++ b/suhosin7.c
@@ -273,7 +273,7 @@ PHP_INI_BEGIN()
         STD_S7_INI_BOOLEAN("suhosin.log.file.time",             "1",    PHP_INI_PERDIR|PHP_INI_SYSTEM,  OnUpdateLogBool, log_file_time)
         // STD_S7_INI_BOOLEAN("suhosin.log.phpscript.is_safe",  "0",    PHP_INI_PERDIR|PHP_INI_SYSTEM,  OnUpdateLogBool, log_phpscript_is_safe)
 
-        // STD_S7_INI_ENTRY("suhosin.executor.include.max_traversal",           "0",    PHP_INI_PERDIR|PHP_INI_SYSTEM,  OnUpdateExecLong, executor_include_max_traversal)
+        STD_S7_INI_ENTRY("suhosin.executor.include.max_traversal",              "0",    PHP_INI_PERDIR|PHP_INI_SYSTEM,  OnUpdateExecLong, executor_include_max_traversal)
         PHP_INI_ENTRY("suhosin.executor.include.whitelist",     NULL,   PHP_INI_PERDIR|PHP_INI_SYSTEM,  OnUpdateSuhosin_include_whitelist)
         PHP_INI_ENTRY("suhosin.executor.include.blacklist",     NULL,   PHP_INI_PERDIR|PHP_INI_SYSTEM,  OnUpdateSuhosin_include_blacklist)
         // STD_S7_INI_BOOLEAN("suhosin.executor.include.allow_writable_files",  "1",            PHP_INI_PERDIR|PHP_INI_SYSTEM,  OnUpdateExecBool, executor_include_allow_writable_files)
@@ -285,7 +285,7 @@ PHP_INI_BEGIN()
         // STD_S7_INI_BOOLEAN("suhosin.executor.disable_emodifier",     "0",    PHP_INI_PERDIR|PHP_INI_SYSTEM,  OnUpdateExecBool, executor_disable_emod)
         // 
         // STD_S7_INI_BOOLEAN("suhosin.executor.allow_symlink", "0",            PHP_INI_PERDIR|PHP_INI_SYSTEM,  OnUpdateExecBool, executor_allow_symlink)
-        // STD_S7_INI_ENTRY("suhosin.executor.max_depth",               "750",          PHP_INI_PERDIR|PHP_INI_SYSTEM,  OnUpdateExecLong, max_execution_depth)
+        STD_S7_INI_ENTRY("suhosin.executor.max_depth",          "750",          PHP_INI_PERDIR|PHP_INI_SYSTEM,  OnUpdateExecLong, max_execution_depth)
         // 
         // 
         // STD_S7_INI_BOOLEAN("suhosin.multiheader",                    "0",    PHP_INI_PERDIR|PHP_INI_SYSTEM,  OnUpdateMiscBool, allow_multiheader)
@@ -302,43 +302,43 @@ PHP_INI_BEGIN()
         
         
         // 
-        // STD_S7_INI_ENTRY("suhosin.request.max_vars", "1000", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateRequestLong, max_request_variables)
-        // STD_S7_INI_ENTRY("suhosin.request.max_varname_length", "64", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateRequestLong, max_varname_length)
-        // STD_S7_INI_ENTRY("suhosin.request.max_value_length", "1000000", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateRequestLong, max_value_length)
-        // STD_S7_INI_ENTRY("suhosin.request.max_array_depth", "50", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateRequestLong, max_array_depth)
-        // STD_S7_INI_ENTRY("suhosin.request.max_totalname_length", "256", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateRequestLong, max_totalname_length)
-        // STD_S7_INI_ENTRY("suhosin.request.max_array_index_length", "64", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateRequestLong, max_array_index_length)
-        // STD_S7_INI_ENTRY("suhosin.request.array_index_whitelist", "", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateRequestString, array_index_whitelist)
-        // STD_S7_INI_ENTRY("suhosin.request.array_index_blacklist", "'\"+<>;()", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateRequestString, array_index_blacklist)
-        // STD_S7_INI_ENTRY("suhosin.request.disallow_nul", "1", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateRequestBool, disallow_nul)
-        // STD_S7_INI_ENTRY("suhosin.request.disallow_ws", "0", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateRequestBool, disallow_ws)
+        STD_S7_INI_ENTRY("suhosin.request.max_vars",    "1000", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateRequestLong, max_request_variables)
+        STD_S7_INI_ENTRY("suhosin.request.max_varname_length", "64", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateRequestLong, max_varname_length)
+        STD_S7_INI_ENTRY("suhosin.request.max_value_length", "1000000", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateRequestLong, max_value_length)
+        STD_S7_INI_ENTRY("suhosin.request.max_array_depth", "50", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateRequestLong, max_array_depth)
+        STD_S7_INI_ENTRY("suhosin.request.max_totalname_length", "256", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateRequestLong, max_totalname_length)
+        STD_S7_INI_ENTRY("suhosin.request.max_array_index_length", "64", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateRequestLong, max_array_index_length)
+        STD_S7_INI_ENTRY("suhosin.request.array_index_char_whitelist", "", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateRequestString, array_index_whitelist)
+        STD_S7_INI_ENTRY("suhosin.request.array_index_char_blacklist", "'\"+<>;()", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateRequestString, array_index_blacklist)
+        STD_S7_INI_ENTRY("suhosin.request.disallow_nul", "1", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateRequestBool, disallow_nul)
+        STD_S7_INI_ENTRY("suhosin.request.disallow_ws", "0", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateRequestBool, disallow_ws)
         // 
-        // STD_S7_INI_ENTRY("suhosin.cookie.max_vars", "100", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateCookieLong, max_cookie_vars)
-        // STD_S7_INI_ENTRY("suhosin.cookie.max_name_length", "64", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateCookieLong, max_cookie_name_length)
-        // STD_S7_INI_ENTRY("suhosin.cookie.max_totalname_length", "256", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateCookieLong, max_cookie_totalname_length)
-        // STD_S7_INI_ENTRY("suhosin.cookie.max_value_length", "10000", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateCookieLong, max_cookie_value_length)
-        // STD_S7_INI_ENTRY("suhosin.cookie.max_array_depth", "50", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateCookieLong, max_cookie_array_depth)
-        // STD_S7_INI_ENTRY("suhosin.cookie.max_array_index_length", "64", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateCookieLong, max_cookie_array_index_length)
-        // STD_S7_INI_ENTRY("suhosin.cookie.disallow_nul", "1", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateCookieBool, disallow_cookie_nul)
-        // STD_S7_INI_ENTRY("suhosin.cookie.disallow_ws", "1", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateCookieBool, disallow_cookie_ws)
+        STD_S7_INI_ENTRY("suhosin.cookie.max_vars", "100", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateCookieLong, max_cookie_vars)
+        STD_S7_INI_ENTRY("suhosin.cookie.max_name_length", "64", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateCookieLong, max_cookie_name_length)
+        STD_S7_INI_ENTRY("suhosin.cookie.max_totalname_length", "256", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateCookieLong, max_cookie_totalname_length)
+        STD_S7_INI_ENTRY("suhosin.cookie.max_value_length", "10000", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateCookieLong, max_cookie_value_length)
+        STD_S7_INI_ENTRY("suhosin.cookie.max_array_depth", "50", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateCookieLong, max_cookie_array_depth)
+        STD_S7_INI_ENTRY("suhosin.cookie.max_array_index_length", "64", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateCookieLong, max_cookie_array_index_length)
+        STD_S7_INI_ENTRY("suhosin.cookie.disallow_nul", "1", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateCookieBool, disallow_cookie_nul)
+        STD_S7_INI_ENTRY("suhosin.cookie.disallow_ws", "1", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateCookieBool, disallow_cookie_ws)
         // 
-        // STD_S7_INI_ENTRY("suhosin.get.max_vars", "100", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateGetLong, max_get_vars)
-        // STD_S7_INI_ENTRY("suhosin.get.max_name_length", "64", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateGetLong, max_get_name_length)
-        // STD_S7_INI_ENTRY("suhosin.get.max_totalname_length", "256", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateGetLong, max_get_totalname_length)
-        // STD_S7_INI_ENTRY("suhosin.get.max_value_length", "512", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateGetLong, max_get_value_length)
-        // STD_S7_INI_ENTRY("suhosin.get.max_array_depth", "50", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateGetLong, max_get_array_depth)
-        // STD_S7_INI_ENTRY("suhosin.get.max_array_index_length", "64", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateGetLong, max_get_array_index_length)
-        // STD_S7_INI_ENTRY("suhosin.get.disallow_nul", "1", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateGetBool, disallow_get_nul)
-        // STD_S7_INI_ENTRY("suhosin.get.disallow_ws", "0", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateGetBool, disallow_get_ws)
+        STD_S7_INI_ENTRY("suhosin.get.max_vars", "100", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateGetLong, max_get_vars)
+        STD_S7_INI_ENTRY("suhosin.get.max_name_length", "64", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateGetLong, max_get_name_length)
+        STD_S7_INI_ENTRY("suhosin.get.max_totalname_length", "256", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateGetLong, max_get_totalname_length)
+        STD_S7_INI_ENTRY("suhosin.get.max_value_length", "512", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateGetLong, max_get_value_length)
+        STD_S7_INI_ENTRY("suhosin.get.max_array_depth", "50", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateGetLong, max_get_array_depth)
+        STD_S7_INI_ENTRY("suhosin.get.max_array_index_length", "64", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateGetLong, max_get_array_index_length)
+        STD_S7_INI_ENTRY("suhosin.get.disallow_nul", "1", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateGetBool, disallow_get_nul)
+        STD_S7_INI_ENTRY("suhosin.get.disallow_ws", "0", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateGetBool, disallow_get_ws)
         // 
-        // STD_S7_INI_ENTRY("suhosin.post.max_vars", "1000", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdatePostLong, max_post_vars)
-        // STD_S7_INI_ENTRY("suhosin.post.max_name_length", "64", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdatePostLong, max_post_name_length)
-        // STD_S7_INI_ENTRY("suhosin.post.max_totalname_length", "256", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdatePostLong, max_post_totalname_length)
-        // STD_S7_INI_ENTRY("suhosin.post.max_value_length", "1000000", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdatePostLong, max_post_value_length)
-        // STD_S7_INI_ENTRY("suhosin.post.max_array_depth", "50", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdatePostLong, max_post_array_depth)
-        // STD_S7_INI_ENTRY("suhosin.post.max_array_index_length", "64", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdatePostLong, max_post_array_index_length)
-        // STD_S7_INI_ENTRY("suhosin.post.disallow_nul", "1", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdatePostBool, disallow_post_nul)
-        // STD_S7_INI_ENTRY("suhosin.post.disallow_ws", "0", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdatePostBool, disallow_post_ws)
+        STD_S7_INI_ENTRY("suhosin.post.max_vars", "1000", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdatePostLong, max_post_vars)
+        STD_S7_INI_ENTRY("suhosin.post.max_name_length", "64", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdatePostLong, max_post_name_length)
+        STD_S7_INI_ENTRY("suhosin.post.max_totalname_length", "256", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdatePostLong, max_post_totalname_length)
+        STD_S7_INI_ENTRY("suhosin.post.max_value_length", "1000000", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdatePostLong, max_post_value_length)
+        STD_S7_INI_ENTRY("suhosin.post.max_array_depth", "50", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdatePostLong, max_post_array_depth)
+        STD_S7_INI_ENTRY("suhosin.post.max_array_index_length", "64", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdatePostLong, max_post_array_index_length)
+        STD_S7_INI_ENTRY("suhosin.post.disallow_nul", "1", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdatePostBool, disallow_post_nul)
+        STD_S7_INI_ENTRY("suhosin.post.disallow_ws", "0", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdatePostBool, disallow_post_ws)
         // 
         // STD_S7_INI_ENTRY("suhosin.upload.max_uploads", "25", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateUploadLong, upload_limit)
         // STD_S7_INI_ENTRY("suhosin.upload.max_newlines", "100", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateUploadLong, upload_max_newlines)
@@ -385,8 +385,8 @@ PHP_INI_BEGIN()
         PHP_INI_ENTRY("suhosin.cookie.cryptlist",       NULL,           PHP_INI_PERDIR|PHP_INI_SYSTEM,  OnUpdateSuhosin_cookie_cryptlist)
         PHP_INI_ENTRY("suhosin.cookie.plainlist",       NULL,           PHP_INI_PERDIR|PHP_INI_SYSTEM,  OnUpdateSuhosin_cookie_plainlist)
         // 
-        // STD_S7_INI_BOOLEAN("suhosin.server.encode", "1", PHP_INI_SYSTEM, OnUpdateBool, server_encode)
-        // STD_S7_INI_BOOLEAN("suhosin.server.strip", "1", PHP_INI_SYSTEM, OnUpdateBool, server_strip)
+        STD_S7_INI_BOOLEAN("suhosin.server.encode", "1", PHP_INI_SYSTEM, OnUpdateBool, server_encode)
+        STD_S7_INI_BOOLEAN("suhosin.server.strip", "1", PHP_INI_SYSTEM, OnUpdateBool, server_strip)
         // 
         // STD_S7_INI_ENTRY("suhosin.rand.seedingkey", "", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateMiscString, seedingkey)
         // STD_S7_INI_BOOLEAN("suhosin.rand.reseed_every_request", "0", PHP_INI_SYSTEM|PHP_INI_PERDIR, OnUpdateMiscBool, reseed_every_request)
@@ -442,22 +442,32 @@ PHP_MINIT_FUNCTION(suhosin7)
         SDEBUG("(MINIT)");
         ZEND_INIT_MODULE_GLOBALS(suhosin7, php_suhosin7_init_globals, NULL);
 
-        /* only register constants if they have not previously been registered by a patched PHP */
-        // if (zend_hash_str_exists(EG(zend_constants), "S_MEMORY", sizeof("S_MEMORY"))==0) {
-                REGISTER_MAIN_LONG_CONSTANT("S_MEMORY", S_MEMORY, CONST_PERSISTENT | CONST_CS);
-                REGISTER_MAIN_LONG_CONSTANT("S_VARS", S_VARS, CONST_PERSISTENT | CONST_CS);
-                REGISTER_MAIN_LONG_CONSTANT("S_FILES", S_FILES, CONST_PERSISTENT | CONST_CS);
-                REGISTER_MAIN_LONG_CONSTANT("S_INCLUDE", S_INCLUDE, CONST_PERSISTENT | CONST_CS);
-                REGISTER_MAIN_LONG_CONSTANT("S_SQL", S_SQL, CONST_PERSISTENT | CONST_CS);
-                REGISTER_MAIN_LONG_CONSTANT("S_EXECUTOR", S_EXECUTOR, CONST_PERSISTENT | CONST_CS);
-                REGISTER_MAIN_LONG_CONSTANT("S_MAIL", S_MAIL, CONST_PERSISTENT | CONST_CS);
-                REGISTER_MAIN_LONG_CONSTANT("S_SESSION", S_SESSION, CONST_PERSISTENT | CONST_CS);
-                REGISTER_MAIN_LONG_CONSTANT("S_MISC", S_MISC, CONST_PERSISTENT | CONST_CS);
-                REGISTER_MAIN_LONG_CONSTANT("S_INTERNAL", S_INTERNAL, CONST_PERSISTENT | CONST_CS);
-                REGISTER_MAIN_LONG_CONSTANT("S_ALL", S_ALL, CONST_PERSISTENT | CONST_CS);
-        // }
+        REGISTER_MAIN_LONG_CONSTANT("S_MEMORY", S_MEMORY, CONST_PERSISTENT | CONST_CS);
+        REGISTER_MAIN_LONG_CONSTANT("S_VARS", S_VARS, CONST_PERSISTENT | CONST_CS);
+        REGISTER_MAIN_LONG_CONSTANT("S_FILES", S_FILES, CONST_PERSISTENT | CONST_CS);
+        REGISTER_MAIN_LONG_CONSTANT("S_INCLUDE", S_INCLUDE, CONST_PERSISTENT | CONST_CS);
+        REGISTER_MAIN_LONG_CONSTANT("S_SQL", S_SQL, CONST_PERSISTENT | CONST_CS);
+        REGISTER_MAIN_LONG_CONSTANT("S_EXECUTOR", S_EXECUTOR, CONST_PERSISTENT | CONST_CS);
+        REGISTER_MAIN_LONG_CONSTANT("S_MAIL", S_MAIL, CONST_PERSISTENT | CONST_CS);
+        REGISTER_MAIN_LONG_CONSTANT("S_SESSION", S_SESSION, CONST_PERSISTENT | CONST_CS);
+        REGISTER_MAIN_LONG_CONSTANT("S_MISC", S_MISC, CONST_PERSISTENT | CONST_CS);
+        REGISTER_MAIN_LONG_CONSTANT("S_INTERNAL", S_INTERNAL, CONST_PERSISTENT | CONST_CS);
+        REGISTER_MAIN_LONG_CONSTANT("S_ALL", S_ALL, CONST_PERSISTENT | CONST_CS);
 
         REGISTER_INI_ENTRIES();
+        
+#if !defined(HAVE_PHP_SESSION) && !defined(SUHOSIN_NO_SESSION_WARNING)
+        php_error_docref(NULL TSRMLS_CC, E_WARNING, "Suhosin was compiled without session support, which is probably not what you want. All session related features will not be available, e.g. session encryption. If session support is really not needed, recompile Suhosin with -DSUHOSIN_NO_SESSION_WARNING=1 to suppress this warning.");
+#endif
+
+        // TODO: stealth loading
+        
+        // hooks
+        // suhosin_hook_memory_limit();
+        suhosin_hook_treat_data();
+        suhosin_hook_execute();
+        suhosin_hook_register_server_variables();
+        
         return SUCCESS;
 }
 /* }}} */
diff --git a/treat_data.c b/treat_data.c
index dc31b17..1c41e85 100644
--- a/treat_data.c
+++ b/treat_data.c
@@ -41,7 +41,7 @@ SAPI_TREAT_DATA_FUNC(suhosin_treat_data)
         zend_long count = 0;
 
         /* Mark that we were not yet called */
-        SUHOSIN7_G(already_scanned) = 0;
+        // SUHOSIN7_G(already_scanned) = 0;
 
         ZVAL_UNDEF(&array);
         switch (arg) {