Re: PHP 4.0 Bug #7597 Updated: similar to #5375. when filtering double slashes from file upload

hello.. Am 14.11.2000 gegen 12 Uhr schrieb 'Bug Database': > ID: 7597 > Updated by: stas > Reported By: shensche@defcom.de > Status: Feedback > Bug Type: *Directory/Filesystem functions > Assigned To: > Comments: > > Can you please print $src before and after the ereg and let > us know what happened there? of course, for example a simple echo (echo "before ereg: $src";): before ereg: /tmp//phpTc5nNp after ereg: /tmp/phpTc5nNp cheers, sebastian > Previous Comments: > --------------------------------------------------------------------------- > > [2000-11-02 13:49:10] shensche@defcom.de > when filtering the double slashes from "tmp_name" from an $HTTP_POST_FILE, it cannot > be moved to the proper location anymore. this is similar to the problem addressed by bugreport #5375 > with windowsNT. > > config: php version 4.03pl1 in safe-mode > with mysql and gd > on a suse linux 6.4 > > well, but i know it is not so much of a problem: just do not tamper with the > "tmp_name" and everything is alright. does anyone know a reason for really doing that? > > > cheers, > sebastian > > ------------ example code ------------------------- > > <?php > > if ($HTTP_POST_VARS["update"] == 1) { > $src = $HTTP_POST_FILES["upload_file"]["tmp_name"]; > > /* > * BUG here: double slashes are stripped and php cannot * move the uploaded file > anymore. > */ > $src = ereg_replace ("//", "/", $src); > > move_uploaded_file ($src, "pic.jpg"); > } > > ?> > > <html> > <body> > > <form action="<?php echo $PHP_SELF ?>" method="POST" > enctype="multipart/form-data"> > <input type="hidden" name="update" value="1"> > > hochladen: <input type="file" name="upload_file"><br> > <img src="pic.jpg"><br> > <input type="submit"> > </form> > > </body> > </html> > > > --------------------------------------------------------------------------- > > > Full Bug description available at: http://bugs.php.net/?id=7597 > > -- Oo.---------------------.oOo.------------------------------------.oO | defcom webdressing gmbh | schlesische str. 27, 10997 berlin | | http://www.defcom.de | phone / fax: +49 30 617 76 99 - 42 / 8 | Oo.---------------------.oOo.------------------------------------.oO

Attachment: [application/pgp-signature]