Re: open_basedir bypass -> errata tempnam()
| From: | Reindl Harald | Date: | Wed, 28 Sep 2011 09:09:31 +0000 |
| Subject: | Re: open_basedir bypass -> errata tempnam() | ||
| References: | 1 2 3 4 5 6 7 8 9 10 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-55650@lists.php.net to get a copy of this message | ||
Am 28.09.2011 10:53, schrieb Pierre Joye:
On Wed, Sep 28, 2011 at 10:50 AM, Reindl Harald <h.reindl@thelounge.net> wrote:
> without any param /tmp is right but not as magical fallback and in
> my opinion a well desigend webapp should never touch global /tmp
> shared with other hosts and applications
Well, a well configured shared host has correct temporary directory set.
In any case, please open a bug at bugs.php.net so we can follow this
possible more closely. Please use the very simply script I use as it
is all we need to debug it.
well, temporary directory must not matter if path is explicit passed via param
https://bugs.php.net/bug.php?id=55804
> Forgot to mention that this behavior is clearly documented:
> http://www.php.net/tempnam
> So it is not sure that we will fix that any time soon.
documentation makes wrong behavior not right
fact is that a php-function must not create files outside open_basedir
with only two eexceptions which are for security reasons
* session save path (must not be in open_basedir)
* upload dir (must not be in open_basedir)
Attachment: [application/pgp-signature] OpenPGP digital signature signature.asc
Attachment: [application/pgp-signature] OpenPGP digital signature signature.asc