#36298 [NEW]: Write files without permission

From: the dot spikey at gmail dot com Operating system: At least *nix PHP version: 4.4.2 PHP Bug Type: Filesystem function related Bug description: Write files without permission Description: ------------ The COPY function can write/read files where you have no permission to. (Maybe in combination with the tempnam function, maybe without). Reproduce code: --------------- $tempfn = tempnam("",""); $temp = fopen($tempfn, "w"); fwrite ($temp, $newtxt); copy ($tempfn, "mysql.php"); Expected result: ---------------- Line 1: $tempfn = the created temporary filename. Line 2: Open the temp. file with write access. Line 3: write your text $newtxt in $temp. Line 4: Copy your newly created temporary file over mysql.php, even without write access. Actual result: -------------- (same as above) Line 1: $tempfn = the created temporary filename. Line 2: Open the temp. file with write access. Line 3: write your text $newtxt in $temp. Line 4: Copy your newly created temporary file over mysql.php, even without write access. -- Edit bug report at http://bugs.php.net/?id=36298&edit=1 -- Try a CVS snapshot (PHP 4.4): http://bugs.php.net/fix.php?id=36298&r=trysnapshot44 Try a CVS snapshot (PHP 5.1): http://bugs.php.net/fix.php?id=36298&r=trysnapshot51 Try a CVS snapshot (PHP 6.0): http://bugs.php.net/fix.php?id=36298&r=trysnapshot60 Fixed in CVS: http://bugs.php.net/fix.php?id=36298&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=36298&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=36298&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=36298&r=needscript Try newer version: http://bugs.php.net/fix.php?id=36298&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=36298&r=support Expected behavior: http://bugs.php.net/fix.php?id=36298&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=36298&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=36298&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=36298&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=36298&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=36298&r=dst IIS Stability: http://bugs.php.net/fix.php?id=36298&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=36298&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=36298&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=36298&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=36298&r=mysqlcfg