#32503 [Com]: fopen() in cwd: filename must start with ./ under safe mode

ID: 32503 Comment by: homechoice2005 at yahoo dot com Reported By: Bjorn dot Wiberg at its dot uu dot se Status: Open Bug Type: Filesystem function related Operating System: IBM AIX 5.2.0.0 ML5 PHP Version: 5CVS-2005-07-05 New Comment: You are welcome to home choice your online choice to day... here at home choice , our goal is to make your shoppoing experience better, faster, easier and safer than ever before? that is why we have compiled a range of products that offers something for everyone... from top quality bed line designs and cookwave to top brand clectronics and appliance. CUSTOMER CARE PLAN everythinmg you order from us is covered by our compreliensive home choice customewre care plan. what does that mean to me?" i hear you ask. peace of mind is what you get? MAIN PRODUCTS: RADIO CD ...ONE YEAR GURANTEE: Nu-tec 3cd hi-fi Lg 3cd hi-fi sansui 3cd battery/mains hi fi sansui 5cd battery/mains hi fi nu tec 5cd hi fi homechoice 3cd hi fi telefunken 3cd hi fi VIDEO RECORDER: LG 2-head video recorder sansui diamond 3 head sansui 2-head video recorder MICROWAVE COOKING: hot plate combo home choice tow-tone combo frying pan combo estia delux grill ideal multi griller zass combo griller home choice mini oven deluxe table top stove twister blender sunbeam kitchen helper magicline magi mixa magicline food processor and blender microwave with grill stainless steel microwave stock pot CURTAIN: Spring flower curtain christina curtain doruble drops curtain luxury set colorado curtain BED BLANKET: electronics blanket bed blanket PHONES DETAILS Nokia 6630 185 USD Nokia 6650 20 USD Nokia 6670 180 USD Nokia 6680 200 USD Nokia 6681 230 USD Nokia 6810 250 USD Nokia 6820 20 USD Nokia 7200 120 USD Nokia 7250 55 USD Nokia 7250i 70 USD Nokia 7260 85 USD Nokia 7270 170 USD Nokia 7280 190 USD Nokia 7600 200 USD Nokia 7610 185 USD Nokia 7650 95 USD Nokia 7710 260 USD Nokia 7700 255 USD Nokia 8800 260 USD Nokia 8910i 110 USD Nokia 9500 300 USD Nokia 9300 190 USD Nokia N70 285 USD Nokia N90 300 USD Nokia N91 325 USD Sonyericsson P910i 295 USD Sonyericsson p910a 320 USD Sonyericsson P900 230 USD Sonyericsson k750i 180 USD Sonyericsson K700i 150 USD Sonyericsson T610i 170 USD Sonyericsson T630 130 USD Sonyericsson K500i 200 USD Sonyericsson W800 180 USD whether its lastest vcr or a beautiful bed linen set that you are intrested in, rest assured that your order we be delivered to your door. thats right... place your order from the comfort of your favourite chair and then just sit back and relax? well take care of everything? SPEEDY DELIVERY... PLASE PROVIDE ALL THE DETAILS WE ASK FOR ON YOUR ORDER FROM, AS THIS WILL ENABLE US TO APPROVE YOUR ORDER QUICKLY AND SAEND TO YOU YOUR GOODS STRAIGHT AWAY. THE FOLLOWNNG INFORMATION IS ESPECIALLY IMPORTANT INPORTANT INFORMATION: . WHAT YOU WANT TO ORDER. . YOUR STREET ADDRESS: IF YOU WANT TO USE OUR CONVENIENT HOME CHOICE DELIVER SERVICE. . YOUR TELEPHONE NUMBER IMPORTANT: IF YOU HAVE ANY QUERIES ABOUT OUR PRODUCTS AND SERVICE S, PLEASE E-MAIL US ON homechoice2005 @yahoo.comOUR FRIENDLY CUSTOMER SERVICE REPRESENTATIVES ARE ALWAYS READY TO HELP YOU. MONDAY TO SATURDAY FROM 8.30 AM TO 7PM. FRIDAY 8.30AM TO 1.PM . EASYPAYMENTTHROUGH. .WESTERN UNIOR MONEY TRANSFER . POSTING THROUGH OUR COMPANY ADDRESS . T/T BANK Previous Comments: ------------------------------------------------------------------------ [2005-12-01 01:18:14] homechoice2005 at yahoo dot com You are welcome to home choice your online choice to day... here at home choice , our goal is to make your shoppoing experience better, faster, easier and safer than ever before? that is why we have compiled a range of products that offers something for everyone... from top quality bed line designs and cookwave to top brand clectronics and appliance. CUSTOMER CARE PLAN everythinmg you order from us is covered by our compreliensive home choice customewre care plan. what does that mean to me?" i hear you ask. peace of mind is what you get? MAIN PRODUCTS: RADIO CD ...ONE YEAR GURANTEE: Nu-tec 3cd hi-fi Lg 3cd hi-fi sansui 3cd battery/mains hi fi sansui 5cd battery/mains hi fi nu tec 5cd hi fi homechoice 3cd hi fi telefunken 3cd hi fi VIDEO RECORDER: LG 2-head video recorder sansui diamond 3 head sansui 2-head video recorder MICROWAVE COOKING: hot plate combo home choice tow-tone combo frying pan combo estia delux grill ideal multi griller zass combo griller home choice mini oven deluxe table top stove twister blender sunbeam kitchen helper magicline magi mixa magicline food processor and blender microwave with grill stainless steel microwave stock pot CURTAIN: Spring flower curtain christina curtain doruble drops curtain luxury set colorado curtain BED BLANKET: electronics blanket bed blanket PHONES DETAILS Nokia 6630 185 USD Nokia 6650 20 USD Nokia 6670 180 USD Nokia 6680 200 USD Nokia 6681 230 USD Nokia 6810 250 USD Nokia 6820 20 USD Nokia 7200 120 USD Nokia 7250 55 USD Nokia 7250i 70 USD Nokia 7260 85 USD Nokia 7270 170 USD Nokia 7280 190 USD Nokia 7600 200 USD Nokia 7610 185 USD Nokia 7650 95 USD Nokia 7710 260 USD Nokia 7700 255 USD Nokia 8800 260 USD Nokia 8910i 110 USD Nokia 9500 300 USD Nokia 9300 190 USD Nokia N70 285 USD Nokia N90 300 USD Nokia N91 325 USD Sonyericsson P910i 295 USD Sonyericsson p910a 320 USD Sonyericsson P900 230 USD Sonyericsson k750i 180 USD Sonyericsson K700i 150 USD Sonyericsson T610i 170 USD Sonyericsson T630 130 USD Sonyericsson K500i 200 USD Sonyericsson W800 180 USD whether its lastest vcr or a beautiful bed linen set that you are intrested in, rest assured that your order we be delivered to your door. thats right... place your order from the comfort of your favourite chair and then just sit back and relax? well take care of everything? SPEEDY DELIVERY... PLASE PROVIDE ALL THE DETAILS WE ASK FOR ON YOUR ORDER FROM, AS THIS WILL ENABLE US TO APPROVE YOUR ORDER QUICKLY AND SAEND TO YOU YOUR GOODS STRAIGHT AWAY. THE FOLLOWNNG INFORMATION IS ESPECIALLY IMPORTANT INPORTANT INFORMATION: . WHAT YOU WANT TO ORDER. . YOUR STREET ADDRESS: IF YOU WANT TO USE OUR CONVENIENT HOME CHOICE DELIVER SERVICE. . YOUR TELEPHONE NUMBER IMPORTANT: IF YOU HAVE ANY QUERIES ABOUT OUR PRODUCTS AND SERVICE S, PLEASE E-MAIL US ON homechoice2005 @yahoo.comOUR FRIENDLY CUSTOMER SERVICE REPRESENTATIVES ARE ALWAYS READY TO HELP YOU. MONDAY TO SATURDAY FROM 8.30 AM TO 7PM. FRIDAY 8.30AM TO 1.PM . EASYPAYMENTTHROUGH. .WESTERN UNIOR MONEY TRANSFER . POSTING THROUGH OUR COMPANY ADDRESS . T/T BANK ------------------------------------------------------------------------ [2005-07-05 11:15:34] Bjorn dot Wiberg at its dot uu dot se Hi again! (Thanks for fixing the mpm_common crash, that problem is gone now.) I'm pasting some test results (also used in bug #53201) here. All the following with #define HAVE_BROKEN_GETCWD 1 in main/php_config.h, and the following code (tests 1-4): <?php print getcwd() . "<BR>"; $handle = fopen("a.txt", "w", false); if ( $handle != FALSE ) { fputs($handle, "testtext"); fclose($handle); } ?> ..and, respectively (tests 5-8): <?php print getcwd() . "<BR>"; $handle = fopen("./a.txt", "w", false); if ( $handle != FALSE ) { fputs($handle, "testtext"); fclose($handle); } ?> 1. No existing "a.txt" file in the destination directory. With the "read" flag missing to the "test" directory along the path, and write permissions to the destination directory: Warning: fopen(): open_basedir restriction in effect. File(a.txt) is not within the allowed path(s): (.:/apache/php/lib/php/:/apache/htdocs/bwiberg/) in /apache/htdocs/bwiberg/test/safemode/write.php on line 5 Warning: fopen(a.txt): failed to open stream: Not owner in /apache/htdocs/bwiberg/test/safemode/write.php on line 5 No file gets created. getcwd() fails. 2. No existing "a.txt" file in the destination directory. Having both read and execute flags along the path, and write permissions to the destination directory: /apache/htdocs/bwiberg/test/safemode Warning: fopen(): Unable to access a.txt in /apache/htdocs/bwiberg/test/safemode/write.php on line 5 Warning: fopen(a.txt): failed to open stream: No such file or directory in /apache/htdocs/bwiberg/test/safemode/write.php on line 5 No file gets created. But getcwd() correctly returns " /apache/htdocs/bwiberg/test/safemode". 3. No existing "a.txt" file in the destination directory. Trying with "./a.txt" instead, a missing "read" flag to the "test" directory along the path, and write permissions to the destination directory: No error message. The a.txt file gets correctly created, but getcwd() fails. 4. No existing "a.txt" file in the destination directory. Trying with "./a.txt", both "read" and "execute" flags along the path, and write permissions to the destination directory: No error message. The file gets correctly created, and getcwd() returns "/apache/htdocs/bwiberg/test/safemode". 5. Existing "a.txt" file in the destination directory. With the "read" flag missing to the "test" directory along the path, and write permissions to the destination directory: Warning: fopen(): open_basedir restriction in effect. File(a.txt) is not within the allowed path(s): (.:/apache/php/lib/php/:/apache/htdocs/bwiberg/) in /apache/htdocs/bwiberg/test/safemode/write.php on line 5 Warning: fopen(a.txt): failed to open stream: Not owner in /apache/htdocs/bwiberg/test/safemode/write.php on line 5 File does not get overwritten. getcwd() fails. 6. Existing "a.txt" file in the destination directory. Having both read and execute flags along the path, and write permissions to the destination directory: No error message. File gets overwritten correctly. getcwd() returns "/apache/htdocs/bwiberg/test/safemode". 7. Existing "a.txt" file in the destination directory. Trying with "./a.txt" instead, a missing "read" flag to the "test" directory along the path, and write permissions to the destination directory: No error message. File gets overwritten correctly, but getcwd() fails. 8. Existing "a.txt" file in the destination directory. Trying with "./a.txt", both "read" and "execute" flags along the path, and write permissions to the destination directory: No error message. File gets overwritten correctly. getcwd() returns "/apache/htdocs/bwiberg/test/safemode". I don't know if these results are useless because of the custom HAVE_BROKEN_GETCWD 1 setting? Perhaps the tests would need to be redone without that modification? Best regards, Björn ------------------------------------------------------------------------ [2005-07-05 10:21:38] Bjorn dot Wiberg at its dot uu dot se (Thanks for fixing the mpm_common crash, that problem is gone now.) With #define HAVE_BROKEN_GETCWD 1 in php_config.h, and having made sure that the path up to the directory where the file is to be created has sufficient permissions, I still get the same error: /apache/htdocs/bwiberg/test/safemode Warning: fopen(): Unable to access a.txt in /apache/htdocs/bwiberg/test/safemode/write.php on line 5 Warning: fopen(a.txt): failed to open stream: No such file or directory in /apache/htdocs/bwiberg/test/safemode/write.php on line 5 Having the read (r) permission off for the "test" directory along the way: Warning: fopen(): open_basedir restriction in effect. File(a.txt) is not within the allowed path(s): (.:/apache/php/lib/php/:/apache/htdocs/bwiberg/) in /apache/htdocs/bwiberg/test/safemode/write.php on line 5 Warning: fopen(a.txt): failed to open stream: Not owner in /apache/htdocs/bwiberg/test/safemode/write.php on line 5 Best regards, Björn ------------------------------------------------------------------------ [2005-05-09 14:15:53] Bjorn dot Wiberg at its dot uu dot se Hi again! I just tried the #define HAVE_BROKEN_GETCWD 1 trick from http://bugs.php.net/bug.php?id=32501, with PHP 5.0.4 (the "fixed" version) but that didn't help in this regard. I thought I would mention this. Best regards, Björn ------------------------------------------------------------------------ [2005-04-05 09:28:28] Bjorn dot Wiberg at its dot uu dot se Hi Tony! Thank you for your feedback! I'm afraid that absolute paths aren't a very viable solution to this, as that probably would break too many scripts, expecting it to be possible to "just" save a file to the current directory. Is the "PHP realpath hack" supposed to handle these kind of problems on AIX? Please let me know if I can help in any way! Best regards, Björn ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at http://bugs.php.net/32503 -- Edit this bug report at http://bugs.php.net/?id=32503&edit=1