Fix for HTTP_PROXY issue.

The following changes are made:
- _SERVER/_ENV only has HTTP_PROXY if the local environment has it,
  and only one from the environment.
- getenv('HTTP_PROXY') only returns one from the local environment
- getenv has optional second parameter, telling it to only consider
  local environment

UPGRADING

@@ -194,6 +194,9 @@ PHP 5.5 UPGRADE NOTES
 - Since 5.5.4, fputcsv() has fifth parameter escape_char, allowing to
   specify escape char.
 
+- Since 5.5.38, getenv() has optional second parameter, making it only
+  consider local environment and not SAPI environment if true.
+
 4a. unserialize() change
 ------------------------
 

ext/standard/basic_functions.c

@@ -3544,7 +3544,7 @@ PHPAPI double php_get_inf(void) /* {{{ */
 
 #define BASIC_ADD_SUBMODULE(module) \
 	zend_hash_add_empty_element(&basic_submodules, #module, strlen(#module));
-	
+
 #define BASIC_RINIT_SUBMODULE(module) \
 	if (zend_hash_exists(&basic_submodules, #module, strlen(#module))) { \
 		PHP_RINIT(module)(INIT_FUNC_ARGS_PASSTHRU); \
@@ -4013,21 +4013,24 @@ PHP_FUNCTION(long2ip)
  * System Functions *
  ********************/
 
-/* {{{ proto string getenv(string varname)
+/* {{{ proto string getenv(string varname[, bool local_only])
    Get the value of an environment variable */
 PHP_FUNCTION(getenv)
 {
 	char *ptr, *str;
 	int str_len;
+	zend_bool local_only = 0;
 
-	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &str, &str_len) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|b", &str, &str_len, &local_only) == FAILURE) {
 		RETURN_FALSE;
 	}
 
-	/* SAPI method returns an emalloc()'d string */
-	ptr = sapi_getenv(str, str_len TSRMLS_CC);
-	if (ptr) {
-		RETURN_STRING(ptr, 0);
+	if (!local_only) {
+		/* SAPI method returns an emalloc()'d string */
+		ptr = sapi_getenv(str, str_len TSRMLS_CC);
+		if (ptr) {
+			RETURN_STRING(ptr, 0);
+		}
 	}
 #ifdef PHP_WIN32
 	{

main/SAPI.c

@@ -1,4 +1,4 @@
-/* 
+/*
    +----------------------------------------------------------------------+
    | PHP Version 5                                                        |
    +----------------------------------------------------------------------+
@@ -132,7 +132,7 @@ PHP_FUNCTION(header_register_callback)
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "z", &callback_func) == FAILURE) {
 		return;
 	}
-	
+
 	if (!zend_is_callable(callback_func, 0, &callback_name TSRMLS_CC)) {
 		efree(callback_name);
 		RETURN_FALSE;
@@ -160,10 +160,10 @@ static void sapi_run_header_callback(TSRMLS_D)
 	char *callback_name = NULL;
 	char *callback_error = NULL;
 	zval *retval_ptr = NULL;
-	
+
 	if (zend_fcall_info_init(SG(callback_func), 0, &fci, &SG(fci_cache), &callback_name, &callback_error TSRMLS_CC) == SUCCESS) {
 		fci.retval_ptr_ptr = &retval_ptr;
-		
+
 		error = zend_call_function(&fci, &SG(fci_cache) TSRMLS_CC);
 		if (error == FAILURE) {
 			goto callback_failed;
@@ -174,13 +174,13 @@ static void sapi_run_header_callback(TSRMLS_D)
 callback_failed:
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Could not call the sapi_header_callback");
 	}
-	
+
 	if (callback_name) {
 		efree(callback_name);
 	}
 	if (callback_error) {
 		efree(callback_error);
-	}	
+	}
 }
 
 SAPI_API void sapi_handle_post(void *arg TSRMLS_DC)
@@ -386,11 +386,11 @@ SAPI_API void sapi_activate_headers_only(TSRMLS_D)
 	if (SG(request_info).headers_read == 1)
 		return;
 	SG(request_info).headers_read = 1;
-	zend_llist_init(&SG(sapi_headers).headers, sizeof(sapi_header_struct), 
+	zend_llist_init(&SG(sapi_headers).headers, sizeof(sapi_header_struct),
 			(void (*)(void *)) sapi_free_header, 0);
 	SG(sapi_headers).send_default_content_type = 1;
 
-	/* SG(sapi_headers).http_response_code = 200; */ 
+	/* SG(sapi_headers).http_response_code = 200; */
 	SG(sapi_headers).http_status_line = NULL;
 	SG(sapi_headers).mimetype = NULL;
 	SG(read_post_bytes) = 0;
@@ -403,7 +403,7 @@ SAPI_API void sapi_activate_headers_only(TSRMLS_D)
 	SG(global_request_time) = 0;
 
 	/*
-	 * It's possible to override this general case in the activate() callback, 
+	 * It's possible to override this general case in the activate() callback,
 	 * if necessary.
 	 */
 	if (SG(request_info).request_method && !strcmp(SG(request_info).request_method, "HEAD")) {
@@ -465,8 +465,8 @@ SAPI_API void sapi_activate(TSRMLS_D)
 				 * depending on given content type */
 				sapi_read_post_data(TSRMLS_C);
 			} else {
-				/* Any other method with content payload will fill $HTTP_RAW_POST_DATA 
-				 * if it is enabled by always_populate_raw_post_data. 
+				/* Any other method with content payload will fill $HTTP_RAW_POST_DATA
+				 * if it is enabled by always_populate_raw_post_data.
 				 * It's up to the webserver to decide whether to allow a method or not. */
 				SG(request_info).content_type_dup = NULL;
 				if (sapi_module.default_post_reader) {
@@ -497,14 +497,14 @@ static void sapi_send_headers_free(TSRMLS_D)
 		SG(sapi_headers).http_status_line = NULL;
 	}
 }
-	
+
 SAPI_API void sapi_deactivate(TSRMLS_D)
 {
 	zend_llist_destroy(&SG(sapi_headers).headers);
 	if (SG(request_info).post_data) {
 		efree(SG(request_info).post_data);
 	}  else 	if (SG(server_context)) {
-		if(sapi_module.read_post) { 
+		if(sapi_module.read_post) {
 			/* make sure we've consumed all request input data */
 			char dummy[SAPI_POST_BLOCK_SIZE];
 			int read_bytes;
@@ -516,7 +516,7 @@ SAPI_API void sapi_deactivate(TSRMLS_D)
 	}
 	if (SG(request_info).raw_post_data) {
 		efree(SG(request_info).raw_post_data);
-	} 
+	}
 	if (SG(request_info).auth_user) {
 		efree(SG(request_info).auth_user);
 	}
@@ -574,7 +574,7 @@ static int sapi_extract_response_code(const char *header_line)
 			break;
 		}
 	}
-	
+
 	return code;
 }
 
@@ -594,7 +594,7 @@ static void sapi_update_response_code(int ncode TSRMLS_DC)
 	SG(sapi_headers).http_response_code = ncode;
 }
 
-/* 
+/*
  * since zend_llist_del_element only remove one matched item once,
  * we should remove them by ourself
  */
@@ -630,7 +630,7 @@ SAPI_API int sapi_add_header_ex(char *header_line, uint header_line_len, zend_bo
 {
 	sapi_header_line ctr = {0};
 	int r;
-	
+
 	ctr.line = header_line;
 	ctr.line_len = header_line_len;
 
@@ -724,7 +724,7 @@ SAPI_API int sapi_header_op(sapi_header_op_enum op, void *arg TSRMLS_DC)
 		} while(header_line_len && isspace(header_line[header_line_len-1]));
 		header_line[header_line_len]='\0';
 	}
-	
+
 	if (op == SAPI_HEADER_DELETE) {
 		if (strchr(header_line, ':')) {
 			efree(header_line);
@@ -762,7 +762,7 @@ SAPI_API int sapi_header_op(sapi_header_op_enum op, void *arg TSRMLS_DC)
 	sapi_header.header_len = header_line_len;
 
 	/* Check the header for a few cases that we have special support for in SAPI */
-	if (header_line_len>=5 
+	if (header_line_len>=5
 		&& !strncasecmp(header_line, "HTTP/", 5)) {
 		/* filter out the response code */
 		sapi_update_response_code(sapi_extract_response_code(header_line) TSRMLS_CC);
@@ -821,8 +821,8 @@ SAPI_API int sapi_header_op(sapi_header_op_enum op, void *arg TSRMLS_DC)
 					/* Return a Found Redirect if one is not already specified */
 					if (http_response_code) { /* user specified redirect code */
 						sapi_update_response_code(http_response_code TSRMLS_CC);
-					} else if (SG(request_info).proto_num > 1000 && 
-					   SG(request_info).request_method && 
+					} else if (SG(request_info).proto_num > 1000 &&
+					   SG(request_info).request_method &&
 					   strcmp(SG(request_info).request_method, "HEAD") &&
 					   strcmp(SG(request_info).request_method, "GET")) {
 						sapi_update_response_code(303 TSRMLS_CC);
@@ -1011,7 +1011,11 @@ SAPI_API struct stat *sapi_get_stat(TSRMLS_D)
 
 SAPI_API char *sapi_getenv(char *name, size_t name_len TSRMLS_DC)
 {
-	if (sapi_module.getenv) { 
+	if (!strncasecmp(name, "HTTP_PROXY", name_len)) {
+		/* Ugly fix for HTTP_PROXY issue */
+		return NULL;
+	}
+	if (sapi_module.getenv) {
 		char *value, *tmp = sapi_module.getenv(name, name_len TSRMLS_CC);
 		if (tmp) {
 			value = estrdup(tmp);