Re: open_basedir bypass -> errata tempnam()
| From: | Ángel González | Date: | Tue, 27 Sep 2011 22:34:17 +0000 |
| Subject: | Re: open_basedir bypass -> errata tempnam() | ||
| References: | 1 2 3 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-55640@lists.php.net to get a copy of this message | ||
Reindl Harald schrieb:
[root@arrakis:~]$ stat /tmp/rhcsvz8QeBLerrata - it is tempnam() if $dir is not writeable which falls back to /tmp this fallback should not happen if /tmp is NOT in open_basedir and tempname() should spit out the error instead the following fopen() better would be if tempnam() stops and gives out a warning that $dir is not writeable - it had a reason that the $dir param was used and if there is an error it is a bad behavior that php takes something else we are speaking about a programming language and not a gambling machine :-) I had also tried with tempnam() [there's not tempname()], and it correctly spitted an open_basedir error and didn't create the file. Which php version are you using?File: „/tmp/rhcsvz8QeBL“Are you sure it is the fopen() what is making it? I think that some other function/extension may be creating the temporary file /tmp/rhcsvz8QeBL for you to open, which then fails due to the open_basedir.