Re: cvs: php4 /ext/standard basic_functions.c

[I might be a bit late on this thread, but here goes] Streams already respect safe mode, so a long-term goal would be to port all this code to use the streams implementation instead. In the short-term, putting the safe-mode check into VCWD seems like a good idea but isn't VCWD part of TSRM, which is supposed to be independent from PHP (so it can't check the PHP configuration options for safe mode)? --Wez. On 11/05/02, "Zeev Suraski" <zeev@zend.com> wrote: > Any chance we can move this check to the vcwd system? We're fighting a war > we can't win, getting those extra lines of code into each and every place > that deals with files. VCWD is already being used virtually everywhere, so > it may be a good idea to move the checks there. > > At 22:19 11/05/2002, Rasmus Lerdorf wrote: > >rasmus Sat May 11 15:19:51 2002 EDT > > > > Modified files: > > /php4/ext/standard basic_functions.c > > Log: > > Another safe-mode fix. parse_ini_file() did not check > > @ safe-mode fix for parse_ini_file() (Rasmus) > > > > > >Index: php4/ext/standard/basic_functions.c > >diff -u php4/ext/standard/basic_functions.c:1.477 > >php4/ext/standard/basic_functions.c:1.478 > >--- php4/ext/standard/basic_functions.c:1.477 Sat May 11 14:35:59 2002 > >+++ php4/ext/standard/basic_functions.c Sat May 11 15:19:49 2002 > >@@ -17,7 +17,7 @@ > > +----------------------------------------------------------------------+ > > */ > > > >-/* $Id: basic_functions.c,v 1.477 2002/05/11 18:35:59 rasmus Exp $ */ > >+/* $Id: basic_functions.c,v 1.478 2002/05/11 19:19:49 rasmus Exp $ */ > > > > #include "php.h" > > #include "php_streams.h" > >@@ -2471,6 +2471,15 @@ > > } > > > > convert_to_string_ex(filename); > >+ > >+ if (PG(safe_mode) && (!php_checkuid(Z_STRVAL_PP(filename), NULL, > >CHECKUID_ALLOW_ONLY_FILE))) { > >+ RETURN_FALSE; > >+ } > >+ > >+ if (php_check_open_basedir(Z_STRVAL_PP(filename) TSRMLS_CC)) { > >+ RETURN_FALSE; > >+ } > >+ > > fh.handle.fp = VCWD_FOPEN(Z_STRVAL_PP(filename), "r"); > > if (!fh.handle.fp) { > > php_error(E_WARNING, "Cannot open '%s' for reading", > > Z_STRVAL_PP(filename)); > > > > > > > >-- > >PHP CVS Mailing List (http://www.php.net/) > >To unsubscribe, visit: http://www.php.net/unsub.php > > > -- > PHP CVS Mailing List (http://www.php.net/) > To unsubscribe, visit: http://www.php.net/unsub.php