Bug #7597 Updated: similar to #5375. when filtering double slashes from file upload

ID: 7597 Updated by: sniper Reported By: shensche@defcom.de Old Status: Open Status: Feedback Bug Type: Filesystem function related Operating System: Linux 2.2.13 PHP Version: 4.0.6RC2 New Comment: Sorry for late reply. Could you please explain WHY you need to filter the double slashes out? It is not necessary. --Jani Previous Comments: ------------------------------------------------------------------------ [2001-06-05 12:49:23] shensche@defcom.de sorry to say that but it still does not work. if replace the double slashes, the move_uploaded_file() fun returns false without issuing any warning. commenting out the line with the replacement leads to the desired result. code is the same as stated in the initial posting. my system changed slightly (suse 6.3, linux 2.2.13, apache 1.3.9, still mysql and gd-support compiled in) but that should not matter, should it? cheers and thanks for your help, sebastian ------------------------------------------------------------------------ [2001-06-03 01:09:36] sniper@php.net This should be fixed with PHP 4.0.6, please try the latest release candidate: http://www.php.net/~andi/php-4.0.6RC2.tar.gz -Jani ------------------------------------------------------------------------ [2000-11-29 07:45:29] shensche@defcom.de of course, for example a simple echo (echo "before ereg: $src";): before ereg: /tmp//phpTc5nNp after ereg: /tmp/phpTc5nNp ------------------------------------------------------------------------ [2000-11-14 06:10:36] stas@php.net Can you please print $src before and after the ereg and let us know what happened there? ------------------------------------------------------------------------ [2000-11-02 13:49:10] shensche@defcom.de when filtering the double slashes from "tmp_name" from an $HTTP_POST_FILE, it cannot be moved to the proper location anymore. this is similar to the problem addressed by bugreport #5375 with windowsNT. config: php version 4.03pl1 in safe-mode with mysql and gd on a suse linux 6.4 well, but i know it is not so much of a problem: just do not tamper with the "tmp_name" and everything is alright. does anyone know a reason for really doing that? cheers, sebastian ------------ example code ------------------------- <?php if ($HTTP_POST_VARS["update"] == 1) { $src = $HTTP_POST_FILES["upload_file"]["tmp_name"]; /* * BUG here: double slashes are stripped and php cannot * move the uploaded file anymore. */ $src = ereg_replace ("//", "/", $src); move_uploaded_file ($src, "pic.jpg"); } ?> <html> <body> <form action="<?php echo $PHP_SELF ?>" method="POST" enctype="multipart/form-data"> <input type="hidden" name="update" value="1"> hochladen: <input type="file" name="upload_file"><br> <img src="pic.jpg"><br> <input type="submit"> </form> </body> </html> ------------------------------------------------------------------------ Edit this bug report at http://bugs.php.net/?id=7597&edit=1