Bug #11563: FileFunction macro in filestat.c appears to be missing a check (fix included)
| From: | henry at metroweb dot co dot za | Date: | Tue, 19 Jun 2001 16:16:36 +0000 |
| Subject: | Bug #11563: FileFunction macro in filestat.c appears to be missing a check (fix included) | ||
| Groups: | php.dev | ||
| Request: | Send a blank email to php-dev+get-57274@lists.php.net to get a copy of this message | ||
From: henry@metroweb.co.za
Operating system: linux 245
PHP version: 4.0.5
PHP Bug Type: *Function Specific
Bug description: FileFunction macro in filestat.c appears to be missing a check (fix included)
safe_mode off
open_basedir in effect
disable_functions=system exec passthru chmod,...etc...
For ISPs safe_mode is too limiting; we use open_basedir extensively. However, many is_* functions
and all function calls which use the FileFunction macro in filestat.c ignore the open_basedir
restriction completely (the only way around this of course is to disable all those useful funcs).
Fix follows:
Add this line after convert_to_string_ex(filename); \ in filestat.c (about line 628):
if (php_check_open_basedir((*filename)->value.str.val)) RETURN_FALSE; \
--
Edit Bug report at: http://bugs.php.net/?id=11563&edit=1