#22475 [Com]: Include() not limited in safe mode

From: Date: Thu, 23 Oct 2003 15:55:07 +0000
Subject: #22475 [Com]: Include() not limited in safe mode
References: 1  Groups: php.bugs 
Request: Send a blank email to php-bugs+get-49396@lists.php.net to get a copy of this message 
 ID:               22475
 Comment by:       rick_g22 at yahoo dot com
 Reported By:      oliver at summertime dot net
 Status:           No Feedback
 Bug Type:         Filesystem function related
 Operating System: Linux
 PHP Version:      4.3.0
 New Comment:

I checked Security focus webpage. 

http://securityfocus.com/bid/8201/info/

They say that PHP 4.3.2 is vulnerable. Is PHP 4.3.3 not?


Previous Comments:
------------------------------------------------------------------------

[2003-03-09 19:19:40] sniper@php.net

No feedback was provided. The bug is being suspended because
we assume that you are no longer experiencing the problem.
If this is not the case and you are able to provide the
information that was requested earlier, please do so and
change the status of the bug back to "Open". Thank you.



------------------------------------------------------------------------

[2003-02-28 11:00:46] iliaa@php.net

Please try using this CVS snapshot:

  http://snaps.php.net/php4-STABLE-latest.tar.gz
 
For Windows:
 
  http://snaps.php.net/win32/php4-win32-STABLE-latest.zip

Unable to replicate with latest CVS.

------------------------------------------------------------------------

[2003-02-28 07:17:12] oliver at summertime dot net

Hi,

in PHP 4.2.2 I get the following error when I want to include
'/etc/passwd':

Warning: SAFE MODE Restriction in effect. The script whose uid is 500
is not allowed to access /etc/passwd owned by uid 0 in
/home/httpd/htdocs/i.php on line 4

Warning: Failed opening '/etc/passwd' for inclusion
(include_path='.:/usr/local/lib/php') in /home/httpd/htdocs/i.php on
line 4

I just upgraded to PHP 4.3.0 and the file will be included without any
error message!

readfile() performs right:

Warning: readfile() [function.readfile]: SAFE MODE Restriction in
effect. The script whose uid is 500 is not allowed to access
/etc/passwd owned by uid 0 in /home/httpd/htdocs/i.php on line 4

Warning: readfile(/etc/passwd) [function.readfile]: failed to create
stream: Inappropriate ioctl for device in /home/httpd/htdocs/i.php on
line 4

------------------------------------------------------------------------


-- 
Edit this bug report at http://bugs.php.net/?id=22475&edit=1

Thread (5 messages)

« previous php.bugs (#49396) next »