Bug #66395 [Com]: basename function doesn't remove drive letter
Edit report at https://bugs.php.net/bug.php?id=66395&edit=1
ID: 66395
Comment by: php at tokumaru dot org
Reported by: php at tokumaru dot org
Summary: basename function doesn't remove drive letter
Status: Closed
Type: Bug
Package: Filesystem function related
Operating System: Windows
PHP Version: 5.5.7
Assigned To: ab
Block user comment: N
Private report: N
New Comment:
Thank you for the the bug fix.
However, this bug fix still has a problem.
The new basename function returns "c:autoexec.bat" for "c:c:autoexec.bat".
Basename function is used for directory traversal attack protection, so this behavior is not good.
The colon character(:) in NTFS file name is used to express NTFS stream, but PHP cannot treat NTFS
streams.
Therefore, I think that the colon character(:) should be treated in the same way as a slash(/) and a
backslash(\).
Previous Comments:
------------------------------------------------------------------------
[2014-01-04 01:28:45] ab@php.net
Automatic comment on behalf of ab
Revision: http://git.php.net/?p=php-src.git;a=commit;h=46f60fae22b420320f3616e00928d70706cf4f4c
Log: Fixed bug #66395 basename function doesn't remove drive letter
------------------------------------------------------------------------
[2014-01-03 22:09:19] ab@php.net
Fixed according to the docs http://msdn.microsoft.com/en-us/library/aa365247(VS.85).aspx
Please test also 5.4 if possible, the fix will be soon available for tests http://windows.php.net/downloads/snaps/
Thanks
------------------------------------------------------------------------
[2014-01-03 21:46:19] ab@php.net
Automatic comment on behalf of ab
Revision: http://git.php.net/?p=php-src.git;a=commit;h=46f60fae22b420320f3616e00928d70706cf4f4c
Log: Fixed bug #66395 basename function doesn't remove drive letter
------------------------------------------------------------------------
[2014-01-03 07:12:39] php at tokumaru dot org
Description:
------------
basename function doesn't remove drive letter(example C:) on WIndows.
if path includes directory separator characters('\' or '/'), basename function
returns trailing name component of path.
But, if path doesn't include directory separator characters, basename function returns file
name with drive letter.
Test script:
---------------
echo basename('c:autoexec.bat');
Expected result:
----------------
autoexec.bat
Actual result:
--------------
c:autoexec.bat
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=66395&edit=1
Thread (5 messages)