cvs: php-src(PHP_5_0) /ext/curl interface.c

iliaa Wed Oct 5 10:32:57 2005 EDT Modified files: (Branch: PHP_5_0) /php-src/ext/curl interface.c Log: MFH: Missing safe_mode/open_basedir checks for file uploads. http://cvs.php.net/diff.php/php-src/ext/curl/interface.c?r1=1.46.2.8&r2=1.46.2.9&ty=u Index: php-src/ext/curl/interface.c diff -u php-src/ext/curl/interface.c:1.46.2.8 php-src/ext/curl/interface.c:1.46.2.9 --- php-src/ext/curl/interface.c:1.46.2.8 Thu Jun 2 17:04:43 2005 +++ php-src/ext/curl/interface.c Wed Oct 5 10:32:57 2005 @@ -16,7 +16,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: interface.c,v 1.46.2.8 2005/06/02 21:04:43 tony2001 Exp $ */ +/* $Id: interface.c,v 1.46.2.9 2005/10/05 14:32:57 iliaa Exp $ */ #define ZEND_INCLUDE_FULL_WINDOWS_HEADERS @@ -1128,10 +1128,15 @@ * must be explicitly cast to long in curl_formadd * use since curl needs a long not an int. */ if (*postval == '@') { + ++postval; + /* safe_mode / open_basedir check */ + if (php_check_open_basedir(postval TSRMLS_CC) || (PG(safe_mode) && !php_checkuid(postval, "rb+", CHECKUID_CHECK_MODE_PARAM))) { + RETURN_FALSE; + } error = curl_formadd(&first, &last, CURLFORM_COPYNAME, string_key, CURLFORM_NAMELENGTH, (long)string_key_len - 1, - CURLFORM_FILE, ++postval, + CURLFORM_FILE, postval, CURLFORM_END); } else { error = curl_formadd(&first, &last,