#22475 [NEW]: Include() not limited in safe mode

From: oliver at summertime dot net Operating system: Linux PHP version: 4.3.0 PHP Bug Type: Filesystem function related Bug description: Include() not limited in safe mode Hi, in PHP 4.2.2 I get the following error when I want to include '/etc/passwd': Warning: SAFE MODE Restriction in effect. The script whose uid is 500 is not allowed to access /etc/passwd owned by uid 0 in /home/httpd/htdocs/i.php on line 4 Warning: Failed opening '/etc/passwd' for inclusion (include_path='.:/usr/local/lib/php') in /home/httpd/htdocs/i.php on line 4 I just upgraded to PHP 4.3.0 and the file will be included without any error message! readfile() performs right: Warning: readfile() [function.readfile]: SAFE MODE Restriction in effect. The script whose uid is 500 is not allowed to access /etc/passwd owned by uid 0 in /home/httpd/htdocs/i.php on line 4 Warning: readfile(/etc/passwd) [function.readfile]: failed to create stream: Inappropriate ioctl for device in /home/httpd/htdocs/i.php on line 4 -- Edit bug report at http://bugs.php.net/?id=22475&edit=1 -- Try a CVS snapshot: http://bugs.php.net/fix.php?id=22475&r=trysnapshot Fixed in CVS: http://bugs.php.net/fix.php?id=22475&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=22475&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=22475&r=needtrace Try newer version: http://bugs.php.net/fix.php?id=22475&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=22475&r=support Expected behavior: http://bugs.php.net/fix.php?id=22475&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=22475&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=22475&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=22475&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=22475&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=22475&r=dst IIS Stability: http://bugs.php.net/fix.php?id=22475&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=22475&r=gnused