ID: 17466
Comment by: slamb@slamb.org
Reported By: cjones@dualboot.net
Status: Open
Bug Type: Apache2 related
Operating System: Linux 2.4.7-10
PHP Version: 4.2.1
New Comment:
See <http://bugs.php.net/bug.php?id=17858>
- patch available at
<http://www.slamb.org/php-apache2-safemode.patch>.
Previous Comments:
------------------------------------------------------------------------
[2002-08-23 16:40:46] shollatz@d.umn.edu
While this may have been assigned as an Apache 2.x problem,
I observe safe_mode_gid not working for most GIDs, works
for a few, regardless whether the user's GID set includes
it.
The environment is Apache 1.3.26 with PHP 4.2.2 as a module,
under Solaris 2.8.
------------------------------------------------------------------------
[2002-06-20 15:14:06] brian@brian-web.com
That patch I just posted is broken with Apache 2.0.39, apparently the
finfo struct isn't filled in 2.0.39 at the point that I was accessing
it. (Its all 0s). If you move the call to php_apr_finfo2stat to
php_apache_get_stat it works, but then its runs everytime
php_apache_get_stat is called, which I was trying to avoid.
------------------------------------------------------------------------
[2002-06-20 03:07:29] brian@brian-web.com
I hit the same problem too with apache 2.0.36/php 4.2.1. I figured out
where the problem was and fixed it. The apache2filter sapi module
wasn't implementing a get_stat function. You can grab the patch from:
http://www.brian-web.com/misc/apache2-php-safemode.patch
I'm not too familiar with the Apache2 or PHP source, so someone else
should probably take a look at it. Basically, it takes the apr_finfo_t
struct from apache and converts it back to a struct stat for php.
------------------------------------------------------------------------
[2002-05-28 02:24:18] derick@php.net
reclassify as an apache 2 issue
------------------------------------------------------------------------
[2002-05-28 01:15:24] cjones@dualboot.net
Update.
I installed the CVS release (4.3.0-dev) and the problem still exists
there. I switched over to the CGI/commandline install of PHP (4.2.1)
and it works correctly (i.e. when safe_mode is on it gets the correct
uid of the file owner).
------------------------------------------------------------------------
The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
http://bugs.php.net/17466--
Edit this bug report at http://bugs.php.net/?id=17466&edit=1