#23349 [NEW]: safe_mode file UID check not functional when directory owned by user

From: gk at proliberty dot com Operating system: linux PHP version: 4.3.2RC1 PHP Bug Type: *General Issues Bug description: safe_mode file UID check not functional when directory owned by user The output below illustrates this problem: safe_mode UID check is not applied to a file not owned by the user if the user owns the directory iin which it resides. I have not tested to see if this problem is reproducible under other than SAPI/CLI. My php.ini is 'php.ini-recommended'. open_basedir is not set. [greg@p3 safe]$ php -v PHP 4.3.2-RC (cli) (built: Mar 24 2003 12:27:32) [greg@p3 safe]$ cat safe.junk hi [greg@p3 safe]$ ls -al total 12 drwxr-xr-x 2 greg greg 4096 Apr 25 11:48 . drwxrwxr-x 9 greg greg 4096 Apr 25 11:48 .. -rw-r--r-- 1 root root 3 Apr 25 11:46 safe.junk [greg@p3 safe]$ ls -al [greg@p3 safe]$ whoami greg [greg@p3 safe]$ php -d safe_mode=1 -r 'readfile("safe.junk");' hi [greg@p3 safe]$ php -d safe_mode=1 -r 'readfile("/etc/passwd");' PHP Warning: readfile(): SAFE MODE Restriction in effect. The script whose uid is 500 is not allowed to access /etc/passwd owned by uid 0 in Command line code on line 1 PHP Warning: readfile(/etc/passwd): failed to open stream: No such file or directory in Command line code on line 1 [greg@p3 safe]$ cd .. [greg@p3 junk]$ su Password: [root@p3 junk]# chown root:root safe [root@p3 junk]# exit exit [greg@p3 junk]$ cd safe [greg@p3 safe]$ php -d safe_mode=1 -r 'readfile("safe.junk");' PHP Warning: readfile(): SAFE MODE Restriction in effect. The script whose uid is 500 is not allowed to access safe.junk owned by uid 0 in Command line code on line 1 PHP Warning: readfile(safe.junk): failed to open stream: No such file or directory in Command line code on line 1 -- Edit bug report at http://bugs.php.net/?id=23349&edit=1 -- Try a CVS snapshot: http://bugs.php.net/fix.php?id=23349&r=trysnapshot Fixed in CVS: http://bugs.php.net/fix.php?id=23349&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=23349&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=23349&r=needtrace Try newer version: http://bugs.php.net/fix.php?id=23349&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=23349&r=support Expected behavior: http://bugs.php.net/fix.php?id=23349&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=23349&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=23349&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=23349&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=23349&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=23349&r=dst IIS Stability: http://bugs.php.net/fix.php?id=23349&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=23349&r=gnused