#38963 [NEW]: tempnam bypasses open_basedir

From: manuel at mausz dot at Operating system: Linux/Gentoo PHP version: 4.4.4 PHP Bug Type: Filesystem function related Bug description: tempnam bypasses open_basedir Description: ------------ tempnam bypasses open_basedir if dir = false Reproduce code: --------------- <?php $tempfile = tempnam(false, "phptest"); ?> Expected result: ---------------- Warning: tempnam() [function.tempnam]: open_basedir restriction in effect. File(/tmp) is not within the allowed path(s): (...) in Actual result: -------------- # ls /tmp/phptest* /tmp/phptestt4mIOa -- Edit bug report at http://bugs.php.net/?id=38963&edit=1 -- Try a CVS snapshot (PHP 4.4): http://bugs.php.net/fix.php?id=38963&r=trysnapshot44 Try a CVS snapshot (PHP 5.2): http://bugs.php.net/fix.php?id=38963&r=trysnapshot52 Try a CVS snapshot (PHP 6.0): http://bugs.php.net/fix.php?id=38963&r=trysnapshot60 Fixed in CVS: http://bugs.php.net/fix.php?id=38963&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=38963&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=38963&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=38963&r=needscript Try newer version: http://bugs.php.net/fix.php?id=38963&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=38963&r=support Expected behavior: http://bugs.php.net/fix.php?id=38963&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=38963&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=38963&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=38963&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=38963&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=38963&r=dst IIS Stability: http://bugs.php.net/fix.php?id=38963&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=38963&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=38963&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=38963&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=38963&r=mysqlcfg