> Is there reason why these functions don't check safe_mode
> and open_basedir?
>
> I don't have much time to test, so I didn't committed this
> patch...
>
Oops. Wrong patch sent. Newer patch attached.
--
Yasuo Ohgaki
? file.c.patch
Index: file.c
===================================================================
RCS file: /repository/php4/ext/standard/file.c,v
retrieving revision 1.239
diff -u -r1.239 file.c
--- file.c 13 Jul 2002 04:45:21 -0000 1.239
+++ file.c 17 Jul 2002 05:50:47 -0000
@@ -261,8 +261,11 @@
&filename, &filename_len,
&use_include_path) == FAILURE) {
return;
}
-
- php_stream_open_wrapper(filename, "rb", 0, NULL);
+ if (php_check_open_basedir(filename TSRMLS_CC)) {
+ RETURN_FALSE;
+ }
+
+ php_stream_open_wrapper(filename, "rb", use_include_path | ENFORCE_SAFE_MODE |
+REPORT_ERRORS, NULL);
md.stream = php_stream_open_wrapper(filename, "rb",
use_include_path | ENFORCE_SAFE_MODE | REPORT_ERRORS,
@@ -411,6 +414,10 @@
return;
}
+ if (php_check_open_basedir(filename TSRMLS_CC)) {
+ RETURN_FALSE;
+ }
+
stream = php_stream_open_wrapper(filename, "rb",
use_include_path | ENFORCE_SAFE_MODE | REPORT_ERRORS,
NULL);
@@ -457,6 +464,10 @@
&filename, &filename_len,
&use_include_path) == FAILURE) {
return;
}
+ if (php_check_open_basedir(filename TSRMLS_CC)) {
+ RETURN_FALSE;
+ }
+
stream = php_stream_open_wrapper(filename, "rb",
use_include_path | ENFORCE_SAFE_MODE | REPORT_ERRORS,
@@ -526,6 +537,9 @@
convert_to_string_ex(arg1);
convert_to_string_ex(arg2);
+ if (PG(safe_mode) && (!php_checkuid(Z_STRVAL_PP(arg1), NULL,
+CHECKUID_ALLOW_ONLY_DIR))) {
+ RETURN_FALSE;
+ }
if (php_check_open_basedir(Z_STRVAL_PP(arg1) TSRMLS_CC)) {
RETURN_FALSE;
}
@@ -806,6 +820,10 @@
&mode, &mode_len, &use_include_path, &zcontext) ==
FAILURE) {
RETURN_FALSE;
}
+ if (php_check_open_basedir(filename TSRMLS_CC)) {
+ RETURN_FALSE;
+ }
+
if (zcontext) {
context = (php_stream_context*)zend_fetch_resource(&zcontext
TSRMLS_CC, -1, "Stream-Context", NULL, 1, le_stream_context);
ZEND_VERIFY_RESOURCE(context);
@@ -1581,6 +1599,10 @@
WRONG_PARAM_COUNT;
}
convert_to_string_ex(arg1);
+
+ if (php_check_open_basedir(Z_STRVAL_PP(arg1) TSRMLS_CC)) {
+ RETURN_FALSE;
+ }
stream = php_stream_open_wrapper(Z_STRVAL_PP(arg1), "rb",
use_include_path | ENFORCE_SAFE_MODE | REPORT_ERRORS,
--
PHP Development Mailing List <http://www.php.net/>
To unsubscribe, visit: http://www.php.net/unsub.php
