From: lists+php at box dot cz
Operating system: Linux (Gentoo, latest)
PHP version: 5.0.1
PHP Bug Type: Filesystem function related
Bug description: open_basedir check is badly performed under some circumstances
Description:
------------
My setup:
document root is: "/home/wejn/x/docs/html/".
While "/home/wejn/x/docs/html/" is symlink to:
"/home/wejn/x/docs1/html/".
I have safe_mode enabled and open_basedir set to
"/home/wejn/x/docs/html:/home/wejn/x/docs1/html".
With this setup I'm unable to perform:
copy("/home/wejn/x/docs/html/x", "/home/wejn/x/docs/html/y");
when "y" doesn't exist. If I touch "y" prior running the
script, everything runs just fine.
IMO, there is problem with symlink resolving code somewhere under
php_check_specific_open_basedir().
It seems to me that more precise location of the bug is somewhere in
virtual_file_ex() regarding the realpath() call.
Maybe it would be better to perform open_basedir check just on dirs
instead of files (in various filesystem functions)?
Btw, this problem exists also in 4.3.8, which makes me think that it's
there for a LONG time ... unnoticed.
W.
Reproduce code:
---------------
// when all conditions described above are met, this fails:
copy('/home/wejn/x/docs/html/x', '/home/wejn/x/docs/html/y');
Expected result:
----------------
no error.
Actual result:
--------------
Warning: copy() [function.copy]: open_basedir restriction in effect.
File(/home/wejn/x/docs/html/y) is not within the allowed path(s):
(/home/wejn/x/docs/html:/home/wejn/x/docs1/html) in
/home/wejn/x/docs1/html/index.html on line 2
Warning: copy(/home/wejn/x/docs/html/y) [function.copy]: failed to open
stream: Operation not permitted in /home/wejn/x/docs1/html/index.html on
line 2
--
Edit bug report at http://bugs.php.net/?id=30188&edit=1
--
Try a CVS snapshot (php4): http://bugs.php.net/fix.php?id=30188&r=trysnapshot4
Try a CVS snapshot (php5.0): http://bugs.php.net/fix.php?id=30188&r=trysnapshot50
Try a CVS snapshot (php5.1): http://bugs.php.net/fix.php?id=30188&r=trysnapshot51
Fixed in CVS: http://bugs.php.net/fix.php?id=30188&r=fixedcvs
Fixed in release: http://bugs.php.net/fix.php?id=30188&r=alreadyfixed
Need backtrace: http://bugs.php.net/fix.php?id=30188&r=needtrace
Need Reproduce Script: http://bugs.php.net/fix.php?id=30188&r=needscript
Try newer version: http://bugs.php.net/fix.php?id=30188&r=oldversion
Not developer issue: http://bugs.php.net/fix.php?id=30188&r=support
Expected behavior: http://bugs.php.net/fix.php?id=30188&r=notwrong
Not enough info: http://bugs.php.net/fix.php?id=30188&r=notenoughinfo
Submitted twice: http://bugs.php.net/fix.php?id=30188&r=submittedtwice
register_globals: http://bugs.php.net/fix.php?id=30188&r=globals
PHP 3 support discontinued: http://bugs.php.net/fix.php?id=30188&r=php3
Daylight Savings: http://bugs.php.net/fix.php?id=30188&r=dst
IIS Stability: http://bugs.php.net/fix.php?id=30188&r=isapi
Install GNU Sed: http://bugs.php.net/fix.php?id=30188&r=gnused
Floating point limitations: http://bugs.php.net/fix.php?id=30188&r=float
MySQL Configuration Error: http://bugs.php.net/fix.php?id=30188&r=mysqlcfg
