cvs: php4 /ext/db db.c /ext/dbase dbase.c /ext/filepro filepro.c /ext/pgsql pgsql.c /ext/posix posix.c /ext/standard exec.c file.c filestat.c
link.c /ext/zlib zlib.c /main fopen-wrappers.c main.c safe_mode.c safe_mode.h

zeev Sun Jun 25 10:02:47 2000 EDT Modified files: /php4/ext/db db.c /php4/ext/dbase dbase.c /php4/ext/filepro filepro.c /php4/ext/pgsql pgsql.c /php4/ext/posix posix.c /php4/ext/standard exec.c file.c filestat.c link.c /php4/ext/zlib zlib.c /php4/main fopen-wrappers.c main.c safe_mode.c safe_mode.h Log: - I wrote a long msg but the commit didn't go through. - So here is the short version: - a) Start moving to binary opens in Windows - b) Give checkuid_mode() a small face lift including the fopen-wrappers.c - The mode to this function should at least be a #define but that is for - another day. Anyway this whole stuff should be given more face lifts in - the future. Index: php4/ext/db/db.c diff -u php4/ext/db/db.c:1.42 php4/ext/db/db.c:1.43 --- php4/ext/db/db.c:1.42 Sat Jun 24 08:31:06 2000 +++ php4/ext/db/db.c Sun Jun 25 10:02:44 2000 @@ -17,7 +17,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: db.c,v 1.42 2000/06/24 15:31:06 sas Exp $ */ +/* $Id: db.c,v 1.43 2000/06/25 17:02:44 zeev Exp $ */ #define IS_EXT_MODULE #if 1 @@ -289,7 +289,7 @@ return NULL; } - if (PG(safe_mode) && (!php_checkuid(filename, 2))) { + if (PG(safe_mode) && (!php_checkuid(filename, NULL, 2))) { return NULL; } Index: php4/ext/dbase/dbase.c diff -u php4/ext/dbase/dbase.c:1.25 php4/ext/dbase/dbase.c:1.26 --- php4/ext/dbase/dbase.c:1.25 Sat Jun 24 08:31:06 2000 +++ php4/ext/dbase/dbase.c Sun Jun 25 10:02:44 2000 @@ -120,7 +120,7 @@ convert_to_string(dbf_name); convert_to_long(options); - if (PG(safe_mode) && (!php_checkuid(dbf_name->value.str.val, 2))) { + if (PG(safe_mode) && (!php_checkuid(dbf_name->value.str.val, NULL, 2))) { RETURN_FALSE; } @@ -583,7 +583,7 @@ RETURN_FALSE; } - if (PG(safe_mode) && (!php_checkuid(Z_STRVAL_P(filename), 2))) { + if (PG(safe_mode) && (!php_checkuid(Z_STRVAL_P(filename), NULL, 2))) { RETURN_FALSE; } Index: php4/ext/filepro/filepro.c diff -u php4/ext/filepro/filepro.c:1.25 php4/ext/filepro/filepro.c:1.26 --- php4/ext/filepro/filepro.c:1.25 Sat Jun 24 08:31:07 2000 +++ php4/ext/filepro/filepro.c Sun Jun 25 10:02:44 2000 @@ -203,7 +203,7 @@ sprintf(workbuf, "%s/map", dir->value.str.val); - if (PG(safe_mode) && (!php_checkuid(workbuf, 2))) { + if (PG(safe_mode) && (!php_checkuid(workbuf, NULL, 2))) { RETURN_FALSE; } @@ -302,7 +302,7 @@ /* Now read the records in, moving forward recsize-1 bytes each time */ sprintf(workbuf, "%s/key", FP_GLOBAL(fp_database)); - if (PG(safe_mode) && (!php_checkuid(workbuf, 2))) { + if (PG(safe_mode) && (!php_checkuid(workbuf, NULL, 2))) { RETURN_FALSE; } @@ -527,7 +527,7 @@ /* Now read the record in */ sprintf(workbuf, "%s/key", FP_GLOBAL(fp_database)); - if (PG(safe_mode) && (!php_checkuid(workbuf, 2))) { + if (PG(safe_mode) && (!php_checkuid(workbuf, NULL, 2))) { RETURN_FALSE; } Index: php4/ext/pgsql/pgsql.c diff -u php4/ext/pgsql/pgsql.c:1.59 php4/ext/pgsql/pgsql.c:1.60 --- php4/ext/pgsql/pgsql.c:1.59 Fri Jun 23 10:09:54 2000 +++ php4/ext/pgsql/pgsql.c Sun Jun 25 10:02:44 2000 @@ -17,7 +17,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: pgsql.c,v 1.59 2000/06/23 17:09:54 eschmid Exp $ */ +/* $Id: pgsql.c,v 1.60 2000/06/25 17:02:44 zeev Exp $ */ #include <stdlib.h> @@ -1539,7 +1539,7 @@ break; } - if (PG(safe_mode) &&(!php_checkuid(Z_STRVAL_PP(file_in), 2))) { + if (PG(safe_mode) &&(!php_checkuid(Z_STRVAL_PP(file_in), NULL, 2))) { RETURN_FALSE; } Index: php4/ext/posix/posix.c diff -u php4/ext/posix/posix.c:1.16 php4/ext/posix/posix.c:1.17 --- php4/ext/posix/posix.c:1.16 Mon Jun 5 12:47:43 2000 +++ php4/ext/posix/posix.c Sun Jun 25 10:02:45 2000 @@ -27,7 +27,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: posix.c,v 1.16 2000/06/05 19:47:43 andi Exp $ */ +/* $Id: posix.c,v 1.17 2000/06/25 17:02:45 zeev Exp $ */ #include "php.h" @@ -136,7 +136,7 @@ static PHP_MINFO_FUNCTION(posix) { php_info_print_table_start(); - php_info_print_table_row(2, "Revision", "$Revision: 1.16 $"); + php_info_print_table_row(2, "Revision", "$Revision: 1.17 $"); php_info_print_table_end(); } @@ -603,7 +603,7 @@ convert_to_string(path); convert_to_long(mode); - if (php3_ini.safe_mode && (!php_checkuid(path->value.str.val, 3))) { + if (php3_ini.safe_mode && (!php_checkuid(path->value.str.val, NULL, 3))) { RETURN_FALSE; } result = mkfifo(path->value.str.val, mode->value.lval); Index: php4/ext/standard/exec.c diff -u php4/ext/standard/exec.c:1.35 php4/ext/standard/exec.c:1.36 --- php4/ext/standard/exec.c:1.35 Mon Jun 12 12:39:04 2000 +++ php4/ext/standard/exec.c Sun Jun 25 10:02:45 2000 @@ -15,7 +15,7 @@ | Author: Rasmus Lerdorf | +----------------------------------------------------------------------+ */ -/* $Id: exec.c,v 1.35 2000/06/12 19:39:04 andi Exp $ */ +/* $Id: exec.c,v 1.36 2000/06/25 17:02:45 zeev Exp $ */ #include <stdio.h> #include "php.h" @@ -86,11 +86,7 @@ tmp = php_escape_shell_cmd(d); efree(d); d = tmp; -#ifdef PHP_WIN32 fp = V_POPEN(d, "rb"); -#else - fp = V_POPEN(d, "r"); -#endif if (!fp) { php_error(E_WARNING, "Unable to fork [%s]", d); efree(d); @@ -98,11 +94,7 @@ return -1; } } else { /* not safe_mode */ -#ifdef PHP_WIN32 fp = V_POPEN(cmd, "rb"); -#else - fp = V_POPEN(cmd, "r"); -#endif if (!fp) { php_error(E_WARNING, "Unable to fork [%s]", cmd); efree(buf); Index: php4/ext/standard/file.c diff -u php4/ext/standard/file.c:1.92 php4/ext/standard/file.c:1.93 --- php4/ext/standard/file.c:1.92 Thu Jun 22 17:53:33 2000 +++ php4/ext/standard/file.c Sun Jun 25 10:02:45 2000 @@ -17,7 +17,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: file.c,v 1.92 2000/06/23 00:53:33 sas Exp $ */ +/* $Id: file.c,v 1.93 2000/06/25 17:02:45 zeev Exp $ */ /* Synced with php 3.0 revision 1.218 1999-06-16 [ssb] */ @@ -1344,7 +1344,7 @@ convert_to_string_ex(arg1); convert_to_long_ex(arg2); mode = (*arg2)->value.lval; - if (PG(safe_mode) &&(!php_checkuid((*arg1)->value.str.val,3))) { + if (PG(safe_mode) &&(!php_checkuid((*arg1)->value.str.val, NULL, 3))) { RETURN_FALSE; } ret = V_MKDIR((*arg1)->value.str.val,mode); @@ -1369,7 +1369,7 @@ WRONG_PARAM_COUNT; } convert_to_string_ex(arg1); - if (PG(safe_mode) &&(!php_checkuid((*arg1)->value.str.val,1))) { + if (PG(safe_mode) &&(!php_checkuid((*arg1)->value.str.val, NULL, 1))) { RETURN_FALSE; } ret = rmdir((*arg1)->value.str.val); @@ -1563,7 +1563,7 @@ old_name = (*old_arg)->value.str.val; new_name = (*new_arg)->value.str.val; - if (PG(safe_mode) &&(!php_checkuid(old_name, 2))) { + if (PG(safe_mode) &&(!php_checkuid(old_name, NULL, 2))) { RETURN_FALSE; } ret = rename(old_name, new_name); @@ -1669,7 +1669,7 @@ convert_to_string_ex(source); convert_to_string_ex(target); - if (PG(safe_mode) &&(!php_checkuid((*source)->value.str.val,2))) { + if (PG(safe_mode) &&(!php_checkuid((*source)->value.str.val, NULL, 2))) { RETURN_FALSE; } Index: php4/ext/standard/filestat.c diff -u php4/ext/standard/filestat.c:1.40 php4/ext/standard/filestat.c:1.41 --- php4/ext/standard/filestat.c:1.40 Mon Jun 12 07:44:16 2000 +++ php4/ext/standard/filestat.c Sun Jun 25 10:02:45 2000 @@ -16,7 +16,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: filestat.c,v 1.40 2000/06/12 14:44:16 eschmid Exp $ */ +/* $Id: filestat.c,v 1.41 2000/06/25 17:02:45 zeev Exp $ */ #include "php.h" #include "safe_mode.h" @@ -252,7 +252,7 @@ gid = (*group)->value.lval; } - if (PG(safe_mode) &&(!php_checkuid((*filename)->value.str.val,1))) { + if (PG(safe_mode) &&(!php_checkuid((*filename)->value.str.val, NULL, 1))) { RETURN_FALSE; } @@ -300,7 +300,7 @@ uid = (*user)->value.lval; } - if (PG(safe_mode) &&(!php_checkuid((*filename)->value.str.val,1))) { + if (PG(safe_mode) &&(!php_checkuid((*filename)->value.str.val, NULL, 1))) { RETURN_FALSE; } @@ -333,7 +333,7 @@ convert_to_string_ex(filename); convert_to_long_ex(mode); - if (PG(safe_mode) &&(!php_checkuid((*filename)->value.str.val,1))) { + if (PG(safe_mode) &&(!php_checkuid((*filename)->value.str.val, NULL, 1))) { RETURN_FALSE; } @@ -396,7 +396,7 @@ } convert_to_string_ex(filename); - if (PG(safe_mode) &&(!php_checkuid((*filename)->value.str.val,1))) { + if (PG(safe_mode) &&(!php_checkuid((*filename)->value.str.val, NULL, 1))) { if (newtime) efree(newtime); RETURN_FALSE; } Index: php4/ext/standard/link.c diff -u php4/ext/standard/link.c:1.24 php4/ext/standard/link.c:1.25 --- php4/ext/standard/link.c:1.24 Tue Jun 13 11:07:19 2000 +++ php4/ext/standard/link.c Sun Jun 25 10:02:45 2000 @@ -16,7 +16,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: link.c,v 1.24 2000/06/13 18:07:19 andrei Exp $ */ +/* $Id: link.c,v 1.25 2000/06/25 17:02:45 zeev Exp $ */ #include "php.h" #include "php_filestat.h" @@ -110,7 +110,7 @@ convert_to_string_ex(topath); convert_to_string_ex(frompath); - if (PG(safe_mode) && !php_checkuid((*topath)->value.str.val, 2)) { + if (PG(safe_mode) && !php_checkuid((*topath)->value.str.val, NULL, 2)) { RETURN_FALSE; } if (!strncasecmp((*topath)->value.str.val,"http://",7) || !strncasecmp((*topath)->value.str.val,"ftp://",6)) { @@ -141,7 +141,7 @@ convert_to_string_ex(topath); convert_to_string_ex(frompath); - if (PG(safe_mode) && !php_checkuid((*topath)->value.str.val, 2)) { + if (PG(safe_mode) && !php_checkuid((*topath)->value.str.val, NULL, 2)) { RETURN_FALSE; } if (!strncasecmp((*topath)->value.str.val,"http://",7) || !strncasecmp((*topath)->value.str.val,"ftp://",6)) { @@ -171,7 +171,7 @@ } convert_to_string_ex(filename); - if (PG(safe_mode) && !php_checkuid((*filename)->value.str.val, 2)) { + if (PG(safe_mode) && !php_checkuid((*filename)->value.str.val, NULL, 2)) { RETURN_FALSE; } Index: php4/ext/zlib/zlib.c diff -u php4/ext/zlib/zlib.c:1.47 php4/ext/zlib/zlib.c:1.48 --- php4/ext/zlib/zlib.c:1.47 Sat Jun 24 08:31:12 2000 +++ php4/ext/zlib/zlib.c Sun Jun 25 10:02:46 2000 @@ -16,7 +16,7 @@ | Stefan Röhrich <sr@linux.de> | +----------------------------------------------------------------------+ */ -/* $Id: zlib.c,v 1.47 2000/06/24 15:31:12 sas Exp $ */ +/* $Id: zlib.c,v 1.48 2000/06/25 17:02:46 zeev Exp $ */ #define IS_EXT_MODULE #include "php.h" @@ -160,7 +160,7 @@ return php_gzopen_with_path(path, mode, PG(include_path), NULL); } else { - if (options & ENFORCE_SAFE_MODE && PG(safe_mode) && (!php_checkuid(path,1))) { + if (options & ENFORCE_SAFE_MODE && PG(safe_mode) && (!php_checkuid(path, NULL, 1))) { return NULL; } if (php_check_open_basedir(path)) return NULL; @@ -186,7 +186,7 @@ /* Relative path open */ if (*filename == '.') { - if (PG(safe_mode) &&(!php_checkuid(filename,2))) { + if (PG(safe_mode) &&(!php_checkuid(filename, NULL, 2))) { return(NULL); } if (php_check_open_basedir(filename)) return NULL; @@ -209,7 +209,7 @@ } else { strlcpy(trypath,filename,sizeof(trypath)); } - if (!php_checkuid(trypath,2)) { + if (!php_checkuid(trypath, NULL, 2)) { return(NULL); } if (php_check_open_basedir(trypath)) return NULL; @@ -225,7 +225,7 @@ } if (!path || (path && !*path)) { - if (PG(safe_mode) &&(!php_checkuid(filename,2))) { + if (PG(safe_mode) &&(!php_checkuid(filename, NULL, 2))) { return(NULL); } if (php_check_open_basedir(filename)) return NULL; @@ -252,7 +252,7 @@ } snprintf(trypath, MAXPATHLEN, "%s/%s", ptr, filename); if (PG(safe_mode)) { - if (V_STAT(trypath,&sb) == 0 &&(!php_checkuid(trypath,2))) { + if (V_STAT(trypath,&sb) == 0 &&(!php_checkuid(trypath, NULL, 2))) { efree(pathbuf); return(NULL); } Index: php4/main/fopen-wrappers.c diff -u php4/main/fopen-wrappers.c:1.69 php4/main/fopen-wrappers.c:1.70 --- php4/main/fopen-wrappers.c:1.69 Fri Jun 16 01:02:33 2000 +++ php4/main/fopen-wrappers.c Sun Jun 25 10:02:46 2000 @@ -16,7 +16,7 @@ | Jim Winstead <jimw@php.net> | +----------------------------------------------------------------------+ */ -/* $Id: fopen-wrappers.c,v 1.69 2000/06/16 08:02:33 andi Exp $ */ +/* $Id: fopen-wrappers.c,v 1.70 2000/06/25 17:02:46 zeev Exp $ */ #include "php.h" #include "php_globals.h" @@ -246,7 +246,6 @@ PHPAPI FILE *php_fopen_wrapper(char *path, char *mode, int options, int *issock, int *socketd, char **opened_path) { - int cm=2; /* checkuid mode: 2 = if file does not exist, check directory */ PLS_FETCH(); if (opened_path) { @@ -266,10 +265,7 @@ } else { FILE *fp; - if (!strcmp(mode,"r") || !strcmp(mode,"r+")) { - cm=0; - } - if (options & ENFORCE_SAFE_MODE && PG(safe_mode) && (!php_checkuid(path, cm))) { + if (options & ENFORCE_SAFE_MODE && PG(safe_mode) && (!php_checkuid(path, mode, 0))) { return NULL; } if (php_check_open_basedir(path)) { @@ -358,7 +354,7 @@ SG(request_info).path_translated = NULL; return NULL; } - fp = V_FOPEN(filename, "r"); + fp = V_FOPEN(filename, "rb"); /* refuse to open anything that is not a regular file */ if (fp && (0 > fstat(fileno(fp), &st) || !S_ISREG(st.st_mode))) { @@ -393,17 +389,15 @@ char trypath[MAXPATHLEN + 1]; struct stat sb; FILE *fp; - int cm=2; PLS_FETCH(); if (opened_path) { *opened_path = NULL; } - if(!strcmp(mode,"r") || !strcmp(mode,"r+")) cm=0; /* Relative path open */ if (*filename == '.') { - if (PG(safe_mode) && (!php_checkuid(filename, cm))) { + if (PG(safe_mode) && (!php_checkuid(filename, mode, 0))) { return NULL; } if (php_check_open_basedir(filename)) return NULL; @@ -425,7 +419,7 @@ } else { strlcpy(trypath,filename,sizeof(trypath)); } - if (!php_checkuid(trypath, cm)) { + if (!php_checkuid(trypath, mode, 0)) { return NULL; } if (php_check_open_basedir(trypath)) return NULL; @@ -446,7 +440,7 @@ } } if (!path || (path && !*path)) { - if (PG(safe_mode) && (!php_checkuid(filename, cm))) { + if (PG(safe_mode) && (!php_checkuid(filename, mode, 0))) { return NULL; } if (php_check_open_basedir(filename)) { @@ -474,7 +468,7 @@ } snprintf(trypath, MAXPATHLEN, "%s/%s", ptr, filename); if (PG(safe_mode)) { - if (V_STAT(trypath, &sb) == 0 && (!php_checkuid(trypath, cm))) { + if (V_STAT(trypath, &sb) == 0 && (!php_checkuid(trypath, mode, 0))) { efree(pathbuf); return NULL; } @@ -1032,9 +1026,7 @@ if (options & USE_PATH) { fp = php_fopen_with_path((char *) path, mode, PG(include_path), opened_path); } else { - int cm=2; - if(!strcmp(mode,"r") || !strcmp(mode,"r+")) cm=0; - if (options & ENFORCE_SAFE_MODE && PG(safe_mode) && (!php_checkuid(path, cm))) { + if (options & ENFORCE_SAFE_MODE && PG(safe_mode) && (!php_checkuid(path, mode, 0))) { fp = NULL; } else { if (php_check_open_basedir((char *) path)) { Index: php4/main/main.c diff -u php4/main/main.c:1.272 php4/main/main.c:1.273 --- php4/main/main.c:1.272 Thu Jun 22 17:53:33 2000 +++ php4/main/main.c Sun Jun 25 10:02:46 2000 @@ -19,7 +19,7 @@ */ -/* $Id: main.c,v 1.272 2000/06/23 00:53:33 sas Exp $ */ +/* $Id: main.c,v 1.273 2000/06/25 17:02:46 zeev Exp $ */ #include <stdio.h> @@ -493,11 +493,11 @@ FILE *retval; old_chunk_size = php_sock_set_def_chunk_size(1); - retval=php_fopen_wrapper((char *) filename, "r", USE_PATH|IGNORE_URL_WIN, &issock, &socketd, opened_path); + retval=php_fopen_wrapper((char *) filename, "rb", USE_PATH|IGNORE_URL_WIN, &issock, &socketd, opened_path); php_sock_set_def_chunk_size(old_chunk_size); if (issock) { - retval = fdopen(socketd, "r"); + retval = fdopen(socketd, "rb"); } return retval; } Index: php4/main/safe_mode.c diff -u php4/main/safe_mode.c:1.20 php4/main/safe_mode.c:1.21 --- php4/main/safe_mode.c:1.20 Thu May 18 08:34:21 2000 +++ php4/main/safe_mode.c Sun Jun 25 10:02:46 2000 @@ -15,7 +15,7 @@ | Authors: Rasmus Lerdorf <rasmus@lerdorf.on.ca> | +----------------------------------------------------------------------+ */ -/* $Id: safe_mode.c,v 1.20 2000/05/18 15:34:21 zeev Exp $ */ +/* $Id: safe_mode.c,v 1.21 2000/06/25 17:02:46 zeev Exp $ */ #include "php.h" @@ -40,13 +40,21 @@ * 2 - if file does not exist, check directory * 3 - only check directory (needed for mkdir) */ -PHPAPI int php_checkuid(const char *fn, int mode) { +PHPAPI int php_checkuid(const char *fn, char *fopen_mode, int mode) { struct stat sb; int ret; long uid=0L, duid=0L; char *s; if (!fn) return(0); /* path must be provided */ + + if (fopen_mode) { + if (fopen_mode[0] == 'r') { + mode = 0; + } else { + mode = 2; + } + } /* * If given filepath is a URL, allow - safe mode stuff Index: php4/main/safe_mode.h diff -u php4/main/safe_mode.h:1.2 php4/main/safe_mode.h:1.3 --- php4/main/safe_mode.h:1.2 Fri Dec 17 11:16:34 1999 +++ php4/main/safe_mode.h Sun Jun 25 10:02:46 2000 @@ -1,7 +1,7 @@ #ifndef _SAFE_MODE_H_ #define _SAFE_MODE_H_ -extern PHPAPI int php_checkuid(const char *filename, int mode); +extern PHPAPI int php_checkuid(const char *filename, char *fopen_mode, int mode); extern PHPAPI char *php_get_current_user(void); #endif