#31618 [Fbk->Opn]: is_readable() results based on ownership of calling script, not file

From: Date: Fri, 12 Aug 2005 17:11:03 +0000
Subject: #31618 [Fbk->Opn]: is_readable() results based on ownership of calling script, not file
References: 1  Groups: php.bugs 
Request: Send a blank email to php-bugs+get-83465@lists.php.net to get a copy of this message 
 ID:               31618
 User updated by:  kibab at icehouse dot net
 Reported By:      kibab at icehouse dot net
-Status:           Feedback
+Status:           Open
 Bug Type:         Filesystem function related
 Operating System: redhat enterprise
 PHP Version:      5CVS-2005-03-14
 New Comment:

Ok, I tried it out on my dev server and it works!  
is_readable() now returns the correct values based on the 
ownership of the file. 
 
From my initial test: 
 
is_readable: /var/lib/php/test_templ2.php (true) 
TEST 
 
The fopen($myfilename) call, however, still fails with the 
following error message (perhaps I should file this as a 
separate bug report...): 
 
Warning: fopen() [function.fopen]: SAFE MODE Restriction 
in effect. The script whose uid/gid is 49/49 is not 
allowed to access /var/lib/php/test_templ2.php owned by 
uid/gid 0/0 in /var/www/sites/devel/test.php on line 10 
  
 Warning: fopen(/var/lib/php/test_templ2.php) 
[function.fopen]: failed to open stream: Success 
in /var/www/sites/devel/test.php on line 10 
 
And... safe_mode_include_dir on that server is set 
to /var/lib/php.


Previous Comments:
------------------------------------------------------------------------

[2005-08-12 18:03:49] tony2001@php.net

Please try again. It should be there this time.

------------------------------------------------------------------------

[2005-08-12 17:33:29] kibab at icehouse dot net

I can't get to it, I just keep getting a 404 error?

------------------------------------------------------------------------

[2005-08-12 01:00:10] tony2001@php.net

Please try this patch:
http://tony2001.phpclub.net/dev/tmp/bugs_29840_31618.diff
(with the latest snapshot/CVS).

------------------------------------------------------------------------

[2005-08-11 15:57:11] kibab at icehouse dot net

Yes.  I read docs, although I sometimes misunderstand   
them:   
   
Note in my previous post:   
safe_mode_include_dir = /usr/share/pear     
  
Also note that per the documentation  
(http://www.php.net/manual/en/features.safe-mode.php):  
  
"safe_mode_include_dir string  
UID/GID checks are bypassed when including files from this  
directory and its subdirectories (directory must also be  
in include_path or full path must including)." 
  
Certainly  $myfilename = '/usr/share/pear/commonfile.php'; 
is in safe_mode_include dir. 
 
Thus, the error message is incorrect and *is* a PHP bug.

------------------------------------------------------------------------

[2005-08-11 11:10:57] tony2001@php.net

Did you read something about safe_mode before turning it On?

"By default, Safe Mode does a UID compare check when opening files. If
you want to relax this to a GID compare, then turn on safe_mode_gid.
Whether to use UID (FALSE) or GID (TRUE) checking upon file access."
(c) http://www.php.net/manual/en/features.safe-mode.php

So, it's perfectly fine to have these errors and to have FALSE in
is_readable() because you turned safe_mode yourself.
This is expected behaviour.

------------------------------------------------------------------------

The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
    http://bugs.php.net/31618

-- 
Edit this bug report at http://bugs.php.net/?id=31618&edit=1

Thread (38 messages)

« previous php.bugs (#83465) next »