stas Tue Jul 10 17:50:47 2007 UTC Modified files: (Branch: PHP_4_4) /php-src/ext/session mod_files.c Log: always check save_path (issue reported by Maksymilian Arciemowicz) http://cvs.php.net/viewvc.cgi/php-src/ext/session/mod_files.c?r1=1.83.2.9.2.8&r2=1.83.2.9.2.9&diff_format=u Index: php-src/ext/session/mod_files.c diff -u php-src/ext/session/mod_files.c:1.83.2.9.2.8 php-src/ext/session/mod_files.c:1.83.2.9.2.9 --- php-src/ext/session/mod_files.c:1.83.2.9.2.8 Fri Mar 9 10:29:33 2007 +++ php-src/ext/session/mod_files.c Tue Jul 10 17:50:46 2007 @@ -16,7 +16,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: mod_files.c,v 1.83.2.9.2.8 2007/03/09 10:29:33 tony2001 Exp $ */ +/* $Id: mod_files.c,v 1.83.2.9.2.9 2007/07/10 17:50:46 stas Exp $ */ #include "php.h" @@ -264,6 +264,14 @@ } save_path = p + 1; } + + if (PG(safe_mode) && (!php_checkuid(save_path, NULL, CHECKUID_ALLOW_ONLY_DIR))) { + return FAILURE; + } + if (php_check_open_basedir(save_path TSRMLS_CC)) { + return FAILURE; + } + data->basedir_len = strlen(save_path); data->basedir = estrndup(save_path, data->basedir_len);
-- PHP CVS Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php