#19363 [NEW]: PHP safe mode security problem

From: dados@impazz.it Operating system: Linux 2.4.2-2smp PHP version: 4.2.2 PHP Bug Type: Filesystem function related Bug description: PHP safe mode security problem Hello, using apache 1.3.26, I have safe mode on I have a simple single-line script: safemode.php <?print_r($fp = fopen('newsletter.html', 'r'));?> safemode is owned by wbr:wbr and newsletter.html is owned by root:root as you can see -rw-r--r-- 1 root root 22161 Sep 12 00:17 newsletter.html -rw-r--r-- 1 wbr wbr 43 Sep 12 01:24 safemode.php safemode.php execution simply return 'Resource id #1' without errors related to safe mode, even if the owner of the files is not the same If I change the owner of safemode.php $ chown nobody:nobody safemode.php and reload safemode.php I get the expected warning: Warning: SAFE MODE Restriction in effect. The script whose uid is 99 is not allowed to access newsletter.html owned by uid If I change the user back to wbr:wbr --> No warning Helpful info: $ cat /etc/passwd |grep wbr wbr:x:501:501::/www/wbr:/bin/bash $ cat /usr/local/lib/php.ini |grep safe_mode |grep -v "^;" safe_mode = On safe_mode_gid = Off safe_mode_include_dir = "/usr/local/lib/php" safe_mode_exec_dir = safe_mode_allowed_env_vars = PHP_ safe_mode_protected_env_vars = LD_LIBRARY_PATH sql.safe_mode = Off Hope can help Thanks a lot Edoardo Serra -- Edit bug report at http://bugs.php.net/?id=19363&edit=1 -- Try a CVS snapshot: http://bugs.php.net/fix.php?id=19363&r=trysnapshot Fixed in CVS: http://bugs.php.net/fix.php?id=19363&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=19363&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=19363&r=needtrace Try newer version: http://bugs.php.net/fix.php?id=19363&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=19363&r=support Expected behavior: http://bugs.php.net/fix.php?id=19363&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=19363&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=19363&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=19363&r=globals