#37430 [NEW]: opendir() leak

From: tim dot site at gmail dot com Operating system: windows 2000 PHP version: 5.1.4 PHP Bug Type: *Directory/Filesystem functions Bug description: opendir() leak Description: ------------ opendir() lets users browse al files on the server, even the one of other hardisk and ffiles in the htdocs list. Is this bug? this is very bad for the server security. Reproduce code: --------------- <?php function select_files($dir, $label = "", $select_name, $curr_val = "", $char_length = 30) { $teller = 0; if ($handle = opendir($dir)) { $mydir = ($label != "") ? "<label for=\"".$select_name."\">".$label."</label>\n" : ""; $mydir .= "<select name=\"".$select_name."\">\n"; $curr_val = (isset($_REQUEST[$select_name])) ? $_REQUEST[$select_name] : $curr_val; $mydir .= ($curr_val == "") ? " <option value=\"\" selected>...\n" : "<option value=\"\">...\n"; while (false !== ($file = readdir($handle))) { $files[] = $file; } closedir($handle); sort($files); foreach ($files as $val) { if (is_file($dir.$val)) { // show only real files (ver. 1.01) $mydir .= " <option value=\"".$val."\""; $mydir .= ($val == $curr_val) ? " selected>" : ">"; $mydir .= (strlen($val) > $char_length) ? substr($val, 0, $char_length)."...\n" : $val."\n"; $teller++; } } $mydir .= "</select>"; } if ($teller == 0) { $mydir = "No files!"; } else { return $mydir; } } echo select_files("C:/winnt/", "", "", "", "60"); ?> Expected result: ---------------- I espect an error because I entered a folder that should not be visibible for other users Actual result: -------------- I see the files of the C:/winnt dir, but other Files on other harddisks are also possible to see even the files in the htdocs directory are visible, so i can see the files of other users. -- Edit bug report at http://bugs.php.net/?id=37430&edit=1 -- Try a CVS snapshot (PHP 4.4): http://bugs.php.net/fix.php?id=37430&r=trysnapshot44 Try a CVS snapshot (PHP 5.2): http://bugs.php.net/fix.php?id=37430&r=trysnapshot52 Try a CVS snapshot (PHP 6.0): http://bugs.php.net/fix.php?id=37430&r=trysnapshot60 Fixed in CVS: http://bugs.php.net/fix.php?id=37430&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=37430&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=37430&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=37430&r=needscript Try newer version: http://bugs.php.net/fix.php?id=37430&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=37430&r=support Expected behavior: http://bugs.php.net/fix.php?id=37430&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=37430&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=37430&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=37430&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=37430&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=37430&r=dst IIS Stability: http://bugs.php.net/fix.php?id=37430&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=37430&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=37430&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=37430&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=37430&r=mysqlcfg