#19363 [Com]: PHP safe mode security problem

ID: 19363 Comment by: dados@impazz.it Reported By: dados@impazz.it Status: Open Bug Type: Filesystem function related Operating System: Linux 2.4.2-2smp PHP Version: 4.2.2 New Comment: Upgraded to php 4.3.3 --> still having the same problem Previous Comments: ------------------------------------------------------------------------ [2002-09-11 18:57:50] dados@impazz.it Hello, using apache 1.3.26, I have safe mode on I have a simple single-line script: safemode.php <?print_r($fp = fopen('newsletter.html', 'r'));?> safemode is owned by wbr:wbr and newsletter.html is owned by root:root as you can see -rw-r--r-- 1 root root 22161 Sep 12 00:17 newsletter.html -rw-r--r-- 1 wbr wbr 43 Sep 12 01:24 safemode.php safemode.php execution simply return 'Resource id #1' without errors related to safe mode, even if the owner of the files is not the same If I change the owner of safemode.php $ chown nobody:nobody safemode.php and reload safemode.php I get the expected warning: Warning: SAFE MODE Restriction in effect. The script whose uid is 99 is not allowed to access newsletter.html owned by uid If I change the user back to wbr:wbr --> No warning Helpful info: $ cat /etc/passwd |grep wbr wbr:x:501:501::/www/wbr:/bin/bash $ cat /usr/local/lib/php.ini |grep safe_mode |grep -v "^;" safe_mode = On safe_mode_gid = Off safe_mode_include_dir = "/usr/local/lib/php" safe_mode_exec_dir = safe_mode_allowed_env_vars = PHP_ safe_mode_protected_env_vars = LD_LIBRARY_PATH sql.safe_mode = Off Hope can help Thanks a lot Edoardo Serra ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=19363&edit=1