Re: cvs: php4 /ext/standard basic_functions.c

Any chance we can move this check to the vcwd system? We're fighting a war we can't win, getting those extra lines of code into each and every place that deals with files. VCWD is already being used virtually everywhere, so it may be a good idea to move the checks there. At 22:19 11/05/2002, Rasmus Lerdorf wrote:

rasmus          Sat May 11 15:19:51 2002 EDT

Modified files:

    /php4/ext/standard  basic_functions.c

Log: Another safe-mode fix. parse_ini_file() did not check @ safe-mode fix for parse_ini_file() (Rasmus) Index: php4/ext/standard/basic_functions.c diff -u php4/ext/standard/basic_functions.c:1.477 php4/ext/standard/basic_functions.c:1.478 --- php4/ext/standard/basic_functions.c:1.477 Sat May 11 14:35:59 2002 +++ php4/ext/standard/basic_functions.c Sat May 11 15:19:49 2002 @@ -17,7 +17,7 @@

    +----------------------------------------------------------------------+

*/ -/* $Id: basic_functions.c,v 1.477 2002/05/11 18:35:59 rasmus Exp $ */ +/* $Id: basic_functions.c,v 1.478 2002/05/11 19:19:49 rasmus Exp $ */ #include "php.h" #include "php_streams.h" @@ -2471,6 +2471,15 @@

        }

        convert_to_string_ex(filename);

+

+       if (PG(safe_mode) && (!php_checkuid(Z_STRVAL_PP(filename), NULL, CHECKUID_ALLOW_ONLY_FILE))) {
+               RETURN_FALSE;
+       }

+

+       if (php_check_open_basedir(Z_STRVAL_PP(filename) TSRMLS_CC)) {
+               RETURN_FALSE;
+       }

+

        fh.handle.fp = VCWD_FOPEN(Z_STRVAL_PP(filename), "r");
        if (!fh.handle.fp) {
                php_error(E_WARNING, "Cannot open '%s' for reading", Z_STRVAL_PP(filename));

-- PHP CVS Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php