#41655 [Opn->Asn]: open_basedir bypass via glob()

ID: 41655 Updated by: pajoye@php.net Reported By: dr at peytz dot dk -Status: Open +Status: Assigned Bug Type: Safe Mode/open_basedir Operating System: Linux PHP Version: 5.2.3 Assigned To: iliaa Previous Comments: ------------------------------------------------------------------------ [2007-09-17 07:51:11] pajoye@php.net The fix for this bug introduced a regression. Using: $a =glob("/home/pierre/cvs/php52/ext/*/tests/*");' Where: open_basedir = /home/pierre/cvs/php52 glob fails to access this path: Warning: glob(): Unable to access /home/pierre/cvs/php52/ext/*/tests in Command line code on line 1 ------------------------------------------------------------------------ [2007-06-12 12:57:50] iliaa@php.net This bug has been fixed in CVS. Snapshots of the sources are packaged every three hours; this change will be in the next snapshot. You can grab the snapshot at http://snaps.php.net/. Thank you for the report, and for helping us make PHP better. ------------------------------------------------------------------------ [2007-06-11 17:14:02] dr at peytz dot dk Description: ------------ file_exists() etc. does not allow checking the existence of files outside the directories specified in open_basedir. This can be circumvented using glob(). glob() does check open_basedir, but its return type still reveals whether files exist outside open_basedir. The existence of a file can be checked using !is_array(glob($filename)). Reproduce code: --------------- var_dump(glob('/etc/hosts')); var_dump(glob('/etc/does-not-exist')); Expected result: ---------------- bool(false) bool(false) or array(0) { } array(0) { } Actual result: -------------- bool(false) array(0) { } ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=41655&edit=1