cvs: php4 /ext/standard basic_functions.c
| From: | Rasmus Lerdorf | Date: | Sat, 11 May 2002 19:19:51 +0000 |
| Subject: | cvs: php4 /ext/standard basic_functions.c | ||
| Groups: | php.cvs | ||
| Request: | Send a blank email to php-cvs+get-11849@lists.php.net to get a copy of this message | ||
rasmus Sat May 11 15:19:51 2002 EDT
Modified files:
/php4/ext/standard basic_functions.c
Log:
Another safe-mode fix. parse_ini_file() did not check
@ safe-mode fix for parse_ini_file() (Rasmus)
Index: php4/ext/standard/basic_functions.c
diff -u php4/ext/standard/basic_functions.c:1.477 php4/ext/standard/basic_functions.c:1.478
--- php4/ext/standard/basic_functions.c:1.477 Sat May 11 14:35:59 2002
+++ php4/ext/standard/basic_functions.c Sat May 11 15:19:49 2002
@@ -17,7 +17,7 @@
+----------------------------------------------------------------------+
*/
-/* $Id: basic_functions.c,v 1.477 2002/05/11 18:35:59 rasmus Exp $ */
+/* $Id: basic_functions.c,v 1.478 2002/05/11 19:19:49 rasmus Exp $ */
#include "php.h"
#include "php_streams.h"
@@ -2471,6 +2471,15 @@
}
convert_to_string_ex(filename);
+
+ if (PG(safe_mode) && (!php_checkuid(Z_STRVAL_PP(filename), NULL,
CHECKUID_ALLOW_ONLY_FILE))) {
+ RETURN_FALSE;
+ }
+
+ if (php_check_open_basedir(Z_STRVAL_PP(filename) TSRMLS_CC)) {
+ RETURN_FALSE;
+ }
+
fh.handle.fp = VCWD_FOPEN(Z_STRVAL_PP(filename), "r");
if (!fh.handle.fp) {
php_error(E_WARNING, "Cannot open '%s' for reading", Z_STRVAL_PP(filename));