Re: open_basedir bypass -> errata tempnam()

Am 28.09.2011 00:34, schrieb Ángel González: > Reindl Harald schrieb: >> [root@arrakis:~]$ stat /tmp/rhcsvz8QeBL >> File: „/tmp/rhcsvz8QeBL“ >>> Are you sure it is the fopen() what is making it? >>> I think that some other function/extension may be creating the temporary file >>> /tmp/rhcsvz8QeBL for you to open, which then fails due to the open_basedir. >> errata - it is tempnam() if $dir is not writeable which falls back to /tmp >> this fallback should not happen if /tmp is NOT in open_basedir and >> tempname() should spit out the error instead the following fopen() >> >> better would be if tempnam() stops and gives out a warning that $dir is >> not writeable - it had a reason that the $dir param was used and if >> there is an error it is a bad behavior that php takes something else >> >> we are speaking about a programming language and not a gambling machine :-) > I had also tried with tempnam() [there's not tempname()], and it correctly spitted > an open_basedir error and didn't create the file. > Which php version are you using? PLEASE REPLY ONLY TO THE LIST this was the second time that i used one of your two copies and replied off-list the first time, if you get a mail from a mailing-list the sender gets your answer if it goes to the list only :-) 5.3.8 $GLOBALS['cl_api']->folders->temp = dirname(__FILE__) . '/temp/'; that was why i did first not understand why /tmp ever was used and than it took some time to realize that /tmp is used because $GLOBALS['cl_api']->folders->temp was not writeable and that the temporary files were created with zero bytes $tmp_name = str_replace("\\", '/', tempnam($GLOBALS['cl_api']->folders->temp, 'rhcsv')); $fp = fopen($tmp_name, 'wb+'); if($fp) { flock($fp, LOCK_EX); fwrite($fp, $data); flock($fp, LOCK_UN); fclose($fp); }

Attachment: [application/pgp-signature] OpenPGP digital signature signature.asc