PHP 4.0 Bug #3076 Updated: system and popen are ok in safe_mode, not backquotes

ID: 3076 User Update by: djm@web.us.uu.net Status: Analyzed Old-Bug Type: Misbehaving function Bug Type: *General Issues Description: system and popen are ok in safe_mode, not backquotes The affected code hasn't changed significantly in 4.0.3pl1, so this is still relevant. I did just notice one bug in the first line of the diff I submitted: it lets "whatever/.." through (where "/.." is at the end of the string). That would be a third case that should be checked, for correctness. The rest of the patch still applies, except that popen is now V_POPEN. Previous Comments: --------------------------------------------------------------------------- [2000-08-01 00:24:39] waldschrott@php.net user feedback: still appearing --------------------------------------------------------------------------- [2000-07-29 15:16:23] waldschrott@php.net Please verify that it´s still happening using the latest version of PHP (release 4.0.1pl2 or CVS). Patch in here. --------------------------------------------------------------------------- [1999-12-31 17:57:40] djm@web.us.uu.net Support for shell escapes is inconsistent in safe_mode. Functions that use _Exec are ok, but backquotes are disallowed for no good reason I can see. They don't seem to be any more dangerous than exec, system, or popen. I have adapted the safe_mode_exec_dir code from _Exec to shell_exec. I also made the detection of references to parent directories more accurate, screening out false matches (e.g., it would disallow a program called "do...stuff"). I am curious why on Windows, _Exec uses binary mode but shell_exec uses text mode. I didn't do anything about that, but it deserves at least a comment in the code. --- ext/standard/exec.c 1999/12/30 22:31:15 1.1.1.2 +++ ext/standard/exec.c 1999/12/31 22:55:09 @@ -62,7 +62,7 @@ overflow_limit = l; c = strchr(cmd, ' '); if (c) *c = '