#31618 [Opn->Asn]: is_readable() results based on ownership of calling script, not file

ID: 31618 Updated by: tony2001@php.net Reported By: kibab at icehouse dot net -Status: Open +Status: Assigned Bug Type: Filesystem function related Operating System: redhat enterprise PHP Version: 5CVS-2005-03-14 -Assigned To: +Assigned To: tony2001 New Comment: Yes, I've made this intentionally. The file in safe_mode_include_dir can be included, but cannot be opened using fopen() and friends. IMO that's why this directive is called safe_mode_*INCLUDE*_dir. Previous Comments: ------------------------------------------------------------------------ [2005-08-12 19:11:00] kibab at icehouse dot net Ok, I tried it out on my dev server and it works! is_readable() now returns the correct values based on the ownership of the file. From my initial test: is_readable: /var/lib/php/test_templ2.php (true) TEST The fopen($myfilename) call, however, still fails with the following error message (perhaps I should file this as a separate bug report...): Warning: fopen() [function.fopen]: SAFE MODE Restriction in effect. The script whose uid/gid is 49/49 is not allowed to access /var/lib/php/test_templ2.php owned by uid/gid 0/0 in /var/www/sites/devel/test.php on line 10 Warning: fopen(/var/lib/php/test_templ2.php) [function.fopen]: failed to open stream: Success in /var/www/sites/devel/test.php on line 10 And... safe_mode_include_dir on that server is set to /var/lib/php. ------------------------------------------------------------------------ [2005-08-12 18:03:49] tony2001@php.net Please try again. It should be there this time. ------------------------------------------------------------------------ [2005-08-12 17:33:29] kibab at icehouse dot net I can't get to it, I just keep getting a 404 error? ------------------------------------------------------------------------ [2005-08-12 01:00:10] tony2001@php.net Please try this patch: http://tony2001.phpclub.net/dev/tmp/bugs_29840_31618.diff (with the latest snapshot/CVS). ------------------------------------------------------------------------ [2005-08-11 15:57:11] kibab at icehouse dot net Yes. I read docs, although I sometimes misunderstand them: Note in my previous post: safe_mode_include_dir = /usr/share/pear Also note that per the documentation (http://www.php.net/manual/en/features.safe-mode.php): "safe_mode_include_dir string UID/GID checks are bypassed when including files from this directory and its subdirectories (directory must also be in include_path or full path must including)." Certainly $myfilename = '/usr/share/pear/commonfile.php'; is in safe_mode_include dir. Thus, the error message is incorrect and *is* a PHP bug. ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at http://bugs.php.net/31618 -- Edit this bug report at http://bugs.php.net/?id=31618&edit=1