#36297 [NEW]: Bypass open_basedir on windows

From: smartgenius1 at yahoo dot com Operating system: Windows PHP version: 5.1.2 PHP Bug Type: Safe Mode/open_basedir Bug description: Bypass open_basedir on windows Description: ------------ The function chdir() does NOT obey the open_basedir restriction on windows. Chdir() ONLY checks the UID of the directories; and on Windows there are no UIDs. So it is possible to do chdir("../"); and it works on windows; even if the open_basedir restriction is set to "."; which should be blocking it. And to make sure I had open_basedir restriction configured correctly; I tried this: opendir("../"); and sure enough; an error stating that the restriction was on. Reproduce code: --------------- <? chdir("../"); ?> Expected result: ---------------- A PHP error stating that the open_basedir restriction was on Actual result: -------------- It worked. No errors at all; and I was able to open the directory with opendir(getcwd()); after changing the current working directory to the above directory. -- Edit bug report at http://bugs.php.net/?id=36297&edit=1 -- Try a CVS snapshot (PHP 4.4): http://bugs.php.net/fix.php?id=36297&r=trysnapshot44 Try a CVS snapshot (PHP 5.1): http://bugs.php.net/fix.php?id=36297&r=trysnapshot51 Try a CVS snapshot (PHP 6.0): http://bugs.php.net/fix.php?id=36297&r=trysnapshot60 Fixed in CVS: http://bugs.php.net/fix.php?id=36297&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=36297&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=36297&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=36297&r=needscript Try newer version: http://bugs.php.net/fix.php?id=36297&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=36297&r=support Expected behavior: http://bugs.php.net/fix.php?id=36297&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=36297&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=36297&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=36297&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=36297&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=36297&r=dst IIS Stability: http://bugs.php.net/fix.php?id=36297&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=36297&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=36297&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=36297&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=36297&r=mysqlcfg