cvs: php4 /ext/cpdf cpdf.c /ext/pdf pdf.c

iliaa Tue May 20 20:57:33 2003 EDT Modified files: /php4/ext/cpdf cpdf.c /php4/ext/pdf pdf.c Log: Added missing safe_mode checks and corrected a typo in stdout check. Index: php4/ext/cpdf/cpdf.c diff -u php4/ext/cpdf/cpdf.c:1.50 php4/ext/cpdf/cpdf.c:1.51 --- php4/ext/cpdf/cpdf.c:1.50 Tue Jan 14 19:52:06 2003 +++ php4/ext/cpdf/cpdf.c Tue May 20 20:57:33 2003 @@ -16,7 +16,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: cpdf.c,v 1.50 2003/01/15 00:52:06 iliaa Exp $ */ +/* $Id: cpdf.c,v 1.51 2003/05/21 00:57:33 iliaa Exp $ */ /* cpdflib.h -- C language API definitions for ClibPDF library * Copyright (C) 1998 FastIO Systems, All Rights Reserved. */ @@ -426,6 +426,11 @@ if(strcmp(Z_STRVAL_PP(arg2), "-") == 0) php_error_docref(NULL TSRMLS_CC, E_WARNING, "Writing to stdout as described in the ClibPDF manual is not possible if php is used as an Apache module. Write to a memory stream and use cpdf_output_buffer() instead."); #endif + + if (php_check_open_basedir(Z_STRVAL_PP(arg2) TSRMLS_CC) || (PG(safe_mode) && !php_checkuid(Z_STRVAL_PP(arg2), "rb+", CHECKUID_CHECK_MODE_PARAM))) { + RETURN_FALSE; + } + cpdf_setOutputFilename(cpdf, Z_STRVAL_PP(arg2)); } cpdf_init(cpdf); @@ -777,6 +782,10 @@ CPDF_FETCH_CPDFDOC(arg1); convert_to_string_ex(arg2); + if (php_check_open_basedir(Z_STRVAL_PP(arg2) TSRMLS_CC) || (PG(safe_mode) && !php_checkuid(Z_STRVAL_PP(arg2), "rb+", CHECKUID_CHECK_MODE_PARAM))) { + RETURN_FALSE; + } + cpdf_setFontMapFile(pdf, Z_STRVAL_PP(arg2)); RETURN_TRUE; @@ -1923,10 +1932,14 @@ convert_to_string_ex(arg2); #if APACHE - if(strcmp(Z_STRVAL_P(arg2), "-") == 0) + if(strcmp(Z_STRVAL_PP(arg2), "-") == 0) php_error_docref(NULL TSRMLS_CC, E_WARNING, "Writing to stdout as described in the ClibPDF manual is not possible if php is used as an Apache module. Use cpdf_output_buffer() instead."); #endif + if (php_check_open_basedir(Z_STRVAL_PP(arg2) TSRMLS_CC) || (PG(safe_mode) && !php_checkuid(Z_STRVAL_PP(arg2), "wb+", CHECKUID_CHECK_MODE_PARAM))) { + RETURN_FALSE; + } + cpdf_savePDFmemoryStreamToFile(pdf, Z_STRVAL_PP(arg2)); RETURN_TRUE; @@ -1948,6 +1961,11 @@ CPDF_FETCH_CPDFDOC(argv[0]); convert_to_string_ex(argv[1]); + + if (php_check_open_basedir(Z_STRVAL_PP(argv[1]) TSRMLS_CC) || (PG(safe_mode) && !php_checkuid(Z_STRVAL_PP(argv[1]), "rb+", CHECKUID_CHECK_MODE_PARAM))) { + RETURN_FALSE; + } + convert_to_double_ex(argv[2]); convert_to_double_ex(argv[3]); convert_to_double_ex(argv[4]); Index: php4/ext/pdf/pdf.c diff -u php4/ext/pdf/pdf.c:1.122 php4/ext/pdf/pdf.c:1.123 --- php4/ext/pdf/pdf.c:1.122 Mon May 19 20:36:59 2003 +++ php4/ext/pdf/pdf.c Tue May 20 20:57:33 2003 @@ -17,7 +17,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: pdf.c,v 1.122 2003/05/20 00:36:59 iliaa Exp $ */ +/* $Id: pdf.c,v 1.123 2003/05/21 00:57:33 iliaa Exp $ */ /* pdflib 2.02 ... 3.0x is subject to the ALADDIN FREE PUBLIC LICENSE. Copyright (C) 1997-1999 Thomas Merz. 2000-2001 PDFlib GmbH */ @@ -332,7 +332,7 @@ #else php_info_print_table_row(2, "PDFlib GmbH Version", tmp ); #endif - php_info_print_table_row(2, "Revision", "$Revision: 1.122 $" ); + php_info_print_table_row(2, "Revision", "$Revision: 1.123 $" ); php_info_print_table_end(); } @@ -2335,6 +2335,11 @@ if (argc == 2) { convert_to_string_ex(arg2); filename = Z_STRVAL_PP(arg2); + + if (php_check_open_basedir(filename TSRMLS_CC) || (PG(safe_mode) && !php_checkuid(filename, "wb+", CHECKUID_CHECK_MODE_PARAM))) { + RETURN_FALSE; + } + pdf_file = PDF_open_file(pdf, filename); } else { /* open in memory */