#19354 [Opn]: utime (fopen) error in safe mode

ID: 19354 Updated by: sniper@php.net Reported By: tamas@mile.hu Status: Open Bug Type: Filesystem function related Operating System: Linux Slackware 8 -PHP Version: 4.2.3 +PHP Version: 4.2.3, 4.3.0-dev New Comment: Updated version information. Previous Comments: ------------------------------------------------------------------------ [2002-09-13 04:41:43] tamas@mile.hu Dear Sniper I think if you have rwxrwxrwx rights on a file and the directory you can read and write and modify that. Basicly in safe_mode you can read and write files of which owner is equal of the php page. In this case it means you can read and write files which are owned by the "akcio" user who is the owner of the x.php and I have to give for example a chmod 777 because the apache running as nobody. So it's really a bug which wasn't in the previous versions (up to and including 4.1.2) (Yes, I meant 'chmod' instead of 'chown', sorry the local time was about 2 a.m.) ------------------------------------------------------------------------ [2002-09-12 22:09:50] sniper@php.net Stupid question..but if the httpd owner doesn't have rights to write to that file..why should it work?? And I guess you meant 'chmod' instead of 'chown'...? ------------------------------------------------------------------------ [2002-09-12 17:15:41] tamas@mile.hu The error message changed but this version has this bug too: Warning: touch() [function.touch]: Utime failed: Operation not permitted in x.php on line 117 Before the test I made chown 777 on the work file and the directory too again. If I change the owner of the file to the owner of the running process the fopen won't give any error. ------------------------------------------------------------------------ [2002-09-11 08:56:25] sniper@php.net Please try using this CVS snapshot: http://snaps.php.net/php4-latest.tar.gz For Windows: http://snaps.php.net/win32/php4-win32-latest.zip ------------------------------------------------------------------------ [2002-09-11 05:18:25] tamas@mile.hu I've checked the original safe_mode.c and the symptom is same as. ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at http://bugs.php.net/19354 -- Edit this bug report at http://bugs.php.net/?id=19354&edit=1