cvs: php4 /ext/standard basic_functions.c file.c

romolo Fri Mar 23 01:30:51 2001 EDT Modified files: /php4/ext/standard basic_functions.c file.c Log: Added target ownership check in function copy for safe_mode operations Index: php4/ext/standard/basic_functions.c diff -u php4/ext/standard/basic_functions.c:1.320 php4/ext/standard/basic_functions.c:1.321 --- php4/ext/standard/basic_functions.c:1.320 Thu Mar 22 06:43:48 2001 +++ php4/ext/standard/basic_functions.c Fri Mar 23 01:30:51 2001 @@ -17,7 +17,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: basic_functions.c,v 1.320 2001/03/22 14:43:48 elixer Exp $ */ +/* $Id: basic_functions.c,v 1.321 2001/03/23 09:30:51 romolo Exp $ */ #include "php.h" #include "php_main.h" @@ -2490,7 +2490,11 @@ if (!zend_hash_exists(SG(rfc1867_uploaded_files), Z_STRVAL_PP(path), Z_STRLEN_PP(path)+1)) { RETURN_FALSE; } - + + if (PG(safe_mode) &&(!php_checkuid(Z_STRVAL_PP(new_path), NULL, CHECKUID_CHECK_FILE_AND_DIR))) { + RETURN_FALSE; + } + V_UNLINK(Z_STRVAL_PP(new_path)); if (rename(Z_STRVAL_PP(path), Z_STRVAL_PP(new_path))==0) { successful=1; Index: php4/ext/standard/file.c diff -u php4/ext/standard/file.c:1.148 php4/ext/standard/file.c:1.149 --- php4/ext/standard/file.c:1.148 Sun Mar 11 02:08:27 2001 +++ php4/ext/standard/file.c Fri Mar 23 01:30:51 2001 @@ -20,7 +20,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: file.c,v 1.148 2001/03/11 10:08:27 sasha Exp $ */ +/* $Id: file.c,v 1.149 2001/03/23 09:30:51 romolo Exp $ */ /* Synced with php 3.0 revision 1.218 1999-06-16 [ssb] */ @@ -1691,7 +1691,7 @@ { pval **source, **target; PLS_FETCH(); - + if (ARG_COUNT(ht) != 2 || zend_get_parameters_ex(2, &source, &target) == FAILURE) { WRONG_PARAM_COUNT; } @@ -1702,7 +1702,11 @@ if (PG(safe_mode) &&(!php_checkuid((*source)->value.str.val, NULL, CHECKUID_CHECK_FILE_AND_DIR))) { RETURN_FALSE; } - + + if (PG(safe_mode) &&(!php_checkuid((*target)->value.str.val, NULL, CHECKUID_CHECK_FILE_AND_DIR))) { + RETURN_FALSE; + } + if (php_copy_file(Z_STRVAL_PP(source), Z_STRVAL_PP(target))==SUCCESS) { RETURN_TRUE; } else {