CVS update: php3

Date: Monday February 15, 1999 @ 12:25 Author: steffann Update of /repository/php3 In directory asf:/u/temp/cvs-serv28214 Modified Files: ChangeLog fopen-wrappers.c mod_php3.c php3_realpath.c Log Message: Open_basedir can now accept multiple paths. The Apache module now automatically inherits the open_basedir from parent directories. Index: php3/ChangeLog diff -c php3/ChangeLog:1.577 php3/ChangeLog:1.578 *** php3/ChangeLog:1.577 Sun Feb 14 23:04:36 1999 --- php3/ChangeLog Mon Feb 15 12:25:43 1999 *************** *** 1,6 **** --- 1,9 ---- PHP 3.0 CHANGE LOG ChangeLog ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| xxx xx xxxx, Version 3.0.7 + - Change the behaviour of open_basedir. It's now possible to supply more + than one directory. open_basedir paths from parent directories are now + automatically inherited. - fix rand() and mt_rand() to make the ranges work correctly - htmlspecialchars() and htmlentities() are now binary save. - Add extract() function. Index: php3/fopen-wrappers.c diff -c php3/fopen-wrappers.c:1.56 php3/fopen-wrappers.c:1.57 *** php3/fopen-wrappers.c:1.56 Fri Jan 22 16:24:41 1999 --- php3/fopen-wrappers.c Mon Feb 15 12:25:44 1999 *************** *** 27,33 **** | Jim Winstead <jimw@php.net> | +----------------------------------------------------------------------+ */ ! /* $Id: fopen-wrappers.c,v 1.56 1999/01/22 21:24:41 rasmus Exp $ */ #ifdef THREAD_SAFE #include "tls.h" --- 27,33 ---- | Jim Winstead <jimw@php.net> | +----------------------------------------------------------------------+ */ ! /* $Id: fopen-wrappers.c,v 1.57 1999/02/15 17:25:44 steffann Exp $ */ #ifdef THREAD_SAFE #include "tls.h" *************** *** 99,181 **** int _php3_getftpresult(int socketd); /* When open_basedir is not NULL, check if the given filename is located in open_basedir. Returns -1 if error or not in the open_basedir, else 0 When open_basedir is NULL, always return 0 */ ! PHPAPI int _php3_check_open_basedir(char *path) { char resolved_name[MAXPATHLEN]; char local_open_basedir[MAXPATHLEN]; int local_open_basedir_pos; - - /* Only check when open_basedir is available */ - if (php3_ini.open_basedir && *php3_ini.open_basedir) { ! /* Special case basedir==".": Use script-directory */ ! if ((strcmp(php3_ini.open_basedir, ".") == 0) && ! GLOBAL(request_info).filename && ! *GLOBAL(request_info).filename ! ) { ! strcpy(local_open_basedir, GLOBAL(request_info).filename); ! local_open_basedir_pos = strlen(local_open_basedir) - 1; ! /* Strip filename */ while (( #if WIN32|WINNT ! (local_open_basedir[local_open_basedir_pos] != '\\') || #endif ! (local_open_basedir[local_open_basedir_pos] != '/') ) && ! (local_open_basedir_pos >= 0) ) { local_open_basedir[local_open_basedir_pos--] = 0; } ! /* Strip double (back)slashes */ ! if (local_open_basedir_pos > 0) { ! while (( #if WIN32|WINNT ! (local_open_basedir[local_open_basedir_pos-1] == '\\') || #endif ! (local_open_basedir[local_open_basedir_pos-1] == '/') ! ) && ! (local_open_basedir_pos > 0) ! ) { ! local_open_basedir[local_open_basedir_pos--] = 0; ! } ! } ! } else { ! /* Else use the unmodified path */ ! strcpy(local_open_basedir, php3_ini.open_basedir); } ! ! /* Resolve the real path into resolved_name */ ! if (_php3_realpath(path, resolved_name) != NULL) { ! /* Check the path */ #if WIN32|WINNT ! if (strncasecmp(local_open_basedir, resolved_name, strlen(local_open_basedir)) == 0) { #else ! if (strncmp(local_open_basedir, resolved_name, strlen(local_open_basedir)) == 0) { #endif ! /* File is in the right directory */ return 0; - } else { - php3_error(E_WARNING, "open_basedir restriction in effect. File is in wrong directory."); - return -1; } ! } else { ! /* Unable to resolve the real path, return -1 */ ! php3_error(E_WARNING, "open_basedir restriction in effect. Unable to verify location of file."); ! return -1; } ! } else { ! /* open_basedir is not available, return 0 */ ! return 0; } } PHPAPI FILE *php3_fopen_wrapper(char *path, char *mode, int options, int *issock, int *socketd) --- 99,212 ---- int _php3_getftpresult(int socketd); + /* When open_basedir is not NULL, check if the given filename is located in open_basedir. Returns -1 if error or not in the open_basedir, else 0 When open_basedir is NULL, always return 0 */ ! PHPAPI int _php3_check_specific_open_basedir(char *basedir, char *path) { char resolved_name[MAXPATHLEN]; char local_open_basedir[MAXPATHLEN]; int local_open_basedir_pos; ! /* Special case basedir==".": Use script-directory */ ! if ((strcmp(basedir, ".") == 0) && ! GLOBAL(request_info).filename && ! *GLOBAL(request_info).filename ! ) { ! strcpy(local_open_basedir, GLOBAL(request_info).filename); ! local_open_basedir_pos = strlen(local_open_basedir) - 1; ! /* Strip filename */ ! while (( ! #if WIN32|WINNT ! (local_open_basedir[local_open_basedir_pos] != '\\') || ! #endif ! (local_open_basedir[local_open_basedir_pos] != '/') ! ) && ! (local_open_basedir_pos >= 0) ! ) { ! local_open_basedir[local_open_basedir_pos--] = 0; ! } ! ! /* Strip double (back)slashes */ ! if (local_open_basedir_pos > 0) { while (( #if WIN32|WINNT ! (local_open_basedir[local_open_basedir_pos-1] == '\\') || #endif ! (local_open_basedir[local_open_basedir_pos-1] == '/') ) && ! (local_open_basedir_pos > 0) ) { local_open_basedir[local_open_basedir_pos--] = 0; } + } ! } else { ! /* Else use the unmodified path */ ! strcpy(local_open_basedir, basedir); ! } ! ! /* Resolve the real path into resolved_name */ ! if (_php3_realpath(path, resolved_name) != NULL) { ! /* Check the path */ #if WIN32|WINNT ! if (strncasecmp(local_open_basedir, resolved_name, strlen(local_open_basedir)) == 0) { ! #else ! if (strncmp(local_open_basedir, resolved_name, strlen(local_open_basedir)) == 0) { #endif ! /* File is in the right directory */ ! return 0; } else { ! return -1; } ! } else { ! /* Unable to resolve the real path, return -1 */ ! return -1; ! } ! } ! ! PHPAPI int _php3_check_open_basedir(char *path) ! { ! /* Only check when open_basedir is available */ ! if (php3_ini.open_basedir && *php3_ini.open_basedir) { ! char *pathbuf; ! char *ptr; ! char *end; ! ! pathbuf = estrdup(php3_ini.open_basedir); ! ! ptr = pathbuf; ! ! while (ptr && *ptr) { #if WIN32|WINNT ! end = strchr(ptr, ';'); #else ! end = strchr(ptr, ':'); #endif ! if (end != NULL) { ! *end = '\0'; ! end++; ! } ! ! if (_php3_check_specific_open_basedir(ptr, path) == 0) { ! efree(pathbuf); return 0; } ! ! ptr = end; } ! php3_error(E_WARNING, "open_basedir restriction in effect. File is in wrong directory."); ! efree(pathbuf); ! return -1; } + + /* Nothing to check... */ + return 0; } PHPAPI FILE *php3_fopen_wrapper(char *path, char *mode, int options, int *issock, int *socketd) Index: php3/mod_php3.c diff -c php3/mod_php3.c:1.89 php3/mod_php3.c:1.90 *** php3/mod_php3.c:1.89 Wed Jan 27 16:55:47 1999 --- php3/mod_php3.c Mon Feb 15 12:25:44 1999 *************** *** 27,33 **** | (with helpful hints from Dean Gaudet <dgaudet@arctic.org> | +----------------------------------------------------------------------+ */ ! /* $Id: mod_php3.c,v 1.89 1999/01/27 21:55:47 rasmus Exp $ */ #ifdef THREAD_SAFE #include "tls.h" --- 27,33 ---- | (with helpful hints from Dean Gaudet <dgaudet@arctic.org> | +----------------------------------------------------------------------+ */ ! /* $Id: mod_php3.c,v 1.90 1999/02/15 17:25:44 steffann Exp $ */ #ifdef THREAD_SAFE #include "tls.h" *************** *** 336,342 **** if (add->gpc_order != orig.gpc_order) new->gpc_order = add->gpc_order; if (add->error_prepend_string != orig.error_prepend_string) new->error_prepend_string = add->error_prepend_string; if (add->error_append_string != orig.error_append_string) new->error_append_string = add->error_append_string; ! if (add->open_basedir != orig.open_basedir) new->open_basedir = add->open_basedir; if (add->enable_dl != orig.enable_dl) new->enable_dl = add->enable_dl; if (add->ignore_user_abort != orig.ignore_user_abort) new->ignore_user_abort = add->ignore_user_abort; if (add->asp_tags != orig.asp_tags) new->asp_tags = add->asp_tags; --- 336,352 ---- if (add->gpc_order != orig.gpc_order) new->gpc_order = add->gpc_order; if (add->error_prepend_string != orig.error_prepend_string) new->error_prepend_string = add->error_prepend_string; if (add->error_append_string != orig.error_append_string) new->error_append_string = add->error_append_string; ! if (add->open_basedir != orig.open_basedir) { ! if (new->open_basedir == NULL) { ! new->open_basedir = add->open_basedir; ! } else { ! #if WIN32|WINNT ! new->open_basedir = pstrcat(p, add->open_basedir, ";", new->open_basedir, NULL); ! #else ! new->open_basedir = pstrcat(p, add->open_basedir, ":", new->open_basedir, NULL); ! #endif ! } ! } if (add->enable_dl != orig.enable_dl) new->enable_dl = add->enable_dl; if (add->ignore_user_abort != orig.ignore_user_abort) new->ignore_user_abort = add->ignore_user_abort; if (add->asp_tags != orig.asp_tags) new->asp_tags = add->asp_tags; *************** *** 480,486 **** conf->error_append_string = pstrdup(cmd->pool, arg); break; case 18: ! conf->open_basedir = pstrdup(cmd->pool, arg); break; case 19: conf->upload_max_filesize = atol(arg); --- 490,504 ---- conf->error_append_string = pstrdup(cmd->pool, arg); break; case 18: ! if (conf->open_basedir == NULL) { ! conf->open_basedir = pstrdup(cmd->pool, arg); ! } else { ! #if WIN32|WINNT ! conf->open_basedir = pstrcat(cmd->pool, conf->open_basedir, ";", arg, NULL); ! #else ! conf->open_basedir = pstrcat(cmd->pool, conf->open_basedir, ":", arg, NULL); ! #endif ! } break; case 19: conf->upload_max_filesize = atol(arg); *************** *** 588,594 **** {"php3_gpc_order", php3take1handler, (void *)15, OR_OPTIONS, TAKE1, "Set GET-COOKIE-POST order [default is GPC]"}, {"php3_error_prepend_string", php3take1handler, (void *)16, OR_OPTIONS, TAKE1, "String to add before an error message from PHP"}, {"php3_error_append_string", php3take1handler, (void *)17, OR_OPTIONS, TAKE1, "String to add after an error message from PHP"}, ! {"php3_open_basedir", php3take1handler, (void *)18, OR_OPTIONS|RSRC_CONF, TAKE1, "Limit opening of files to this directory"}, {"php3_upload_max_filesize", php3take1handler, (void *)19, OR_OPTIONS|RSRC_CONF, TAKE1, "Limit uploaded files to this many bytes"}, #if HAVE_MOD_DAV {"php3_dav_script", php3take1handler, (void *)20, OR_OPTIONS|RSRC_CONF, TAKE1, --- 606,612 ---- {"php3_gpc_order", php3take1handler, (void *)15, OR_OPTIONS, TAKE1, "Set GET-COOKIE-POST order [default is GPC]"}, {"php3_error_prepend_string", php3take1handler, (void *)16, OR_OPTIONS, TAKE1, "String to add before an error message from PHP"}, {"php3_error_append_string", php3take1handler, (void *)17, OR_OPTIONS, TAKE1, "String to add after an error message from PHP"}, ! {"php3_open_basedir", php3take1handler, (void *)18, OR_OPTIONS|RSRC_CONF, ITERATE, "Limit opening of files to this directory"}, {"php3_upload_max_filesize", php3take1handler, (void *)19, OR_OPTIONS|RSRC_CONF, TAKE1, "Limit uploaded files to this many bytes"}, #if HAVE_MOD_DAV {"php3_dav_script", php3take1handler, (void *)20, OR_OPTIONS|RSRC_CONF, TAKE1, Index: php3/php3_realpath.c diff -c php3/php3_realpath.c:1.10 php3/php3_realpath.c:1.11 *** php3/php3_realpath.c:1.10 Fri Jan 1 12:58:51 1999 --- php3/php3_realpath.c Mon Feb 15 12:25:44 1999 *************** *** 27,33 **** +----------------------------------------------------------------------+ */ ! /* $Id: php3_realpath.c,v 1.10 1999/01/01 17:58:51 zeev Exp $ */ #ifdef THREAD_SAFE #include "tls.h" --- 27,33 ---- +----------------------------------------------------------------------+ */ ! /* $Id: php3_realpath.c,v 1.11 1999/02/15 17:25:44 steffann Exp $ */ #ifdef THREAD_SAFE #include "tls.h" *************** *** 48,53 **** --- 48,59 ---- #define S_ISDIR(mode) (((mode)&S_IFMT) == S_IFDIR) #endif + #if WIN32|WINNT + #define PATH_SEPARATOR '\\' + #else + #define PATH_SEPARATOR '/' + #endif + char *_php3_realpath(char *path, char resolved_path[]); char *_php3_realpath(char *path, char resolved_path []) { *************** *** 126,136 **** /* Go to the end, then stop */ while(*workpos != 0) { /* Strip (back)slashes */ ! #if WIN32|WINNT ! while(*workpos == '\\') workpos++; ! #else ! while(*workpos == '/') workpos++; ! #endif #if WIN32|WINNT /* reset dotcount */ --- 132,138 ---- /* Go to the end, then stop */ while(*workpos != 0) { /* Strip (back)slashes */ ! while(*workpos == PATH_SEPARATOR) workpos++; #if WIN32|WINNT /* reset dotcount */ *************** *** 267,285 **** #endif /* WIN32|WINNT */ } /* Check if the resolved path is a directory */ ! if (stat(path_construction, &filestat) != 0) return NULL; ! if (S_ISDIR(filestat.st_mode)) { ! /* It's a directory, append a / if needed */ ! if (*(writepos-1) != '/') { ! /* Check for overflow */ ! if ((strlen(workpos) + 2) >= MAXPATHLEN) return NULL; ! *writepos++ = '/'; ! *writepos = 0; } } ! strcpy(resolved_path, path_construction); return resolved_path; } --- 269,325 ---- #endif /* WIN32|WINNT */ } + /* We are only interested in the directory */ /* Check if the resolved path is a directory */ ! if (stat(path_construction, &filestat) == 0) { ! /* path_construction exists and stats available */ ! if (S_ISDIR(filestat.st_mode)) { ! /* It's a directory, append a / or \ if needed */ ! if (*(writepos-1) != PATH_SEPARATOR) { ! /* Check for overflow */ ! if ((strlen(workpos) + 2) >= MAXPATHLEN) return NULL; ! ! *writepos++ = PATH_SEPARATOR; ! *writepos = 0; ! } ! } else { ! /* it's a file, strip filename */ ! while (*--writepos != PATH_SEPARATOR); ! *++writepos = 0; ! } ! } else { ! /* it doesn't exist, try to strip the last element */ ! /* if last element ends with a /, skip that / */ ! if (*(writepos-1) == PATH_SEPARATOR) { ! *--writepos = 0; ! } ! ! while (*--writepos != PATH_SEPARATOR); ! *writepos = 0; ! ! /* Now try this */ ! if (stat(path_construction, &filestat) == 0) { ! /* path_construction exists and stats available */ ! if (S_ISDIR(filestat.st_mode)) { ! /* It's a directory, append a / if needed */ ! if (*(writepos-1) != PATH_SEPARATOR) { ! /* Check for overflow */ ! if ((strlen(workpos) + 2) >= MAXPATHLEN) return NULL; ! *writepos++ = PATH_SEPARATOR; ! *writepos = 0; ! } ! } else { ! /* User tries to use something that is not a directory as ! a directory */ ! return NULL; ! } ! } else { ! /* Even this doesn't exist */ ! return NULL; } } ! strcpy(resolved_path, path_construction); return resolved_path; } -- PHP Development Mailing List http://www.php.net/ To unsubscribe send an empty message to php-dev-unsubscribe@lists.php.net For help: php-dev-help@lists.php.net