#32503 [Opn]: fopen() in cwd: filename must start with ./ under safe mode

ID: 32503 User updated by: Bjorn dot Wiberg at its dot uu dot se Reported By: Bjorn dot Wiberg at its dot uu dot se Status: Open Bug Type: Filesystem function related Operating System: IBM AIX 5.2.0.0 ML5 PHP Version: 5CVS-2005-03-31 New Comment: Hi again! I just tried the #define HAVE_BROKEN_GETCWD 1 trick from http://bugs.php.net/bug.php?id=32501, with PHP 5.0.4 (the "fixed" version) but that didn't help in this regard. I thought I would mention this. Best regards, Björn Previous Comments: ------------------------------------------------------------------------ [2005-04-05 09:28:28] Bjorn dot Wiberg at its dot uu dot se Hi Tony! Thank you for your feedback! I'm afraid that absolute paths aren't a very viable solution to this, as that probably would break too many scripts, expecting it to be possible to "just" save a file to the current directory. Is the "PHP realpath hack" supposed to handle these kind of problems on AIX? Please let me know if I can help in any way! Best regards, Björn ------------------------------------------------------------------------ [2005-04-04 17:11:05] tony2001@php.net Right, this is somehow concerned with broken realpath() on AIX. The problem is that we end up with relative path in php_checkuid_ex() function and it fails to check permissions for the directory. Of course, the easiest solution is to use absolute paths everywhere. ------------------------------------------------------------------------ [2005-04-01 16:32:32] Bjorn dot Wiberg at its dot uu dot se Tried php5-200503310630 (5.1.0-dev), but the problem is still present: /apache/htdocs/bwiberg/test/safemode Warning: fopen(): Unable to access a.txt in /apache/htdocs/bwiberg/test/safemode/write.php on line 5 Warning: fopen(a.txt): failed to open stream: No such file or directory in /apache/htdocs/bwiberg/test/safemode/write.php on line 5 (Whereas "./a.txt" works just fine.) Best regards, Björn ------------------------------------------------------------------------ [2005-03-30 17:17:27] sniper@php.net Please try using this CVS snapshot: http://snaps.php.net/php5-latest.tar.gz For Windows: http://snaps.php.net/win32/php5-win32-latest.zip ------------------------------------------------------------------------ [2005-03-30 14:37:04] Bjorn dot Wiberg at its dot uu dot se Description: ------------ Under safe mode, if one tries to create a new file with fopen(), specifying a filename without any path part in it (such as "./a.txt" or /apache/htdocs/bwiberg/test/safemode/a.txt"), fopen() fails, claiming that the file cannot be found. If the file already exists, everything works just fine. If you specify a path part ahead of the filename, everything works just fine. If you give fopen() "true" as a third argument, and make sure that your include_path includes "." as its FIRST path (if you have several directories in it), everything works just fine. (Perhaps the restriction of only trying the FIRST path should be mentioned in the docs as well.) I'm not sure if this problem is related to the earlier discussions of php_realpath_hack (that fix should be present as "_AIX" is set by gcc under AIX), but it sure poses a problem for scripts which rely on being able to create a file in the current directory without specifying any path. Another question is why $handle in the example script isn't set to FALSE if the open failed -- instead the error propagates to the fputs() part. I'd appreciate any input regarding this. Thanks in advance! Best regards, Björn Reproduce code: --------------- <?php print getcwd() . "<BR>"; $handle = fopen("a.txt", "w", false); if ( $handle != FALSE ) { fputs($handle, "testtext"); fclose($handle); } ?> Expected result: ---------------- /apache/htdocs/bwiberg/test/safemode (File a.txt gets created in current directory.) Actual result: -------------- /apache/htdocs/bwiberg/test/safemode Warning: fopen(): Unable to access a.txt in /apache/htdocs/bwiberg/test/safemode/write.php on line 5 Warning: fopen(a.txt): failed to open stream: No such file or directory in /apache/htdocs/bwiberg/test/safemode/write.php on line 5 ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=32503&edit=1