$ _POST variables passing through empty IE7 for one subfolder

Question

I am having problems with $ _POST variables that are not accepted from forms on the PHP website.

To clarify the problem, I created this simple PHP script "POST_test.php":

<? print "POST:<pre>"; print_r($_POST); print "</pre>"; ?> <form method="POST" action="POST_test.php"> <input type="submit" value="Save Changes"> <input type="hidden" name="blah" value="1"> </form> 

Say my Apache web root folder is "web_root", and my website folder is "websiteA". By placing the above script in "web_root / websiteA" and clicking the button in IE7, you get an empty $ _POST array. Changing the name of the folder to "web_root / websiteA2" makes it start working, and also works on other websites in the root directory of websites, such as "website". No problem using Firefox. Recently, NTLM authentication has been enabled on our systems - I don't know if that can make a difference.

Apache and PHP run on a server (somewhat old version) of Debian Linux.

I also tried ctrl refreshing the page in IE, which did not help, and did not restart my computer.

Update: This forum post appears to describe the problem: http://lists.rubyonrails.org/pipermail/rails/2006-March/027283.html

• You cannot send any data to a mixed NTLM and non-NTLM authenticated site website. Microsoft Internet Explorer requires NTLM authentication for everyone visiting a website after visiting one NTLM-authenticated site folder.

I can confirm this behavior as follows:

When I am http: //mydomain/websiteA/index.php , then http: //mydomain/websiteA/POST_test.php $ _POST is not populated by sending the test page.

However, closing all my IE7 windows and then browsing directly to http: //mydomain/websiteA/POST_test.php displays $ _POST IS, filling out the test page.

And one of the proposed solutions from the above related forum post is as follows:

The only way I saw to let IE “forget” that it was previously NTLM-authenticated to the site is to send page status 401. This effectively resets IE authentication status.

Answer 1

Thanks for the suggestions.

It turned out that the problem was caused by a previous request to an unrelated page that used NTLM authentication like this (or the like):

 <?php if (!isset($headers['Authorization'])){ header('HTTP/1.1 401 Unauthorized'); header('WWW-Authenticate: NTLM'); exit; } ?> 

After this authentication, all $ _POST data was received blank until IE was closed and reopened. So far I have been working on the problem by removing the above code and instead suggesting Apache use NTLM inside our intranet (which sets the variable $ _SERVER ['REMOTE_USER']). (Outside of our intranet, Apache authentication is still in use).

Answer 2

After working so hard, I found a trick for this problem. I used all ntlm authentication code as an include file in my php where authentication is performed, and after that I cannot do any form of POST due to problems with mix-ntlm and non-ntlm that will probably change the headers pages.

so you just need to include the same ntlm authentication codes at the top of every page of your site and this will do the trick.

THE PROBLEM IS RESOLVED ... :)

Hope this helps a lot of people.

Answer 3

Try filling out your “action” because I don't think it will actually work to leave this attribute empty in IE7.

Answer 4

This issue can be fixed by disabling pre-authentication in IE. In the registry:

 "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings" 

On the Edit menu, add the name of the DisableNTLMPreAuth value as the REG_DWORD type and set the data value to 1 (true).

For more information, see this error report and Microsoft KB 251404 .