Re: PHP Support Not Taking Issues Seriously

Brian Moon wrote: >> I think that TOny quite explains this issue by even quoting from our >> fine manual. > > > While I agree with your feelings Derick about everything else in John's > email, I am not sure the manual is clear here. > > From his bug report, I changed wsfile.php to: > > <? > > $curdir = getcwd(); You can't do that. Relative include paths are already specified in the INI variable. Using $curdir as a base gives you things like "/home/brianm/public_html//usr/local/lib/php/../inc/incfile.php". Clearly incorrect. I don't think it matters overall, but I wanted to point that out. > $include_path = ini_get('include_path'); > > $paths = explode(":", $include_path); > > foreach($paths as $path){ > if(empty($path)) continue; > echo "Is file found at $curdir/".$path.'/../inc/incfile.php ?'; > > if(file_exists("$curdir/".$path.'/../inc/incfile.php')){ > echo " Yes!\n"; > } else { > echo " No!\n"; > } > > } > > include '../inc/incfile.php'; > > print "Hi! I'm wsfile!\n"; > ?> > > I get: > > Is file found at /home/brianm/public_html/./../inc/incfile.php ? No! > Is file found at > /home/brianm/public_html//usr/local/lib/php/../inc/incfile.php ? No! > Is file found at > /home/brianm/public_html//www/codelib/include/../inc/incfile.php ? No! > Is file found at /home/brianm/public_html/./ws/../inc/incfile.php ? Yes! So that would really make these: Is file found at ./../inc/incfile.php ? No! Is file found at /usr/local/lib/php/../inc/incfile.php ? No! Is file found at /www/codelib/include/../inc/incfile.php ? No! Is file found at ./ws/../inc/incfile.php ? Yes! I'm not sure if the manual is really clear on how include_path works. This code seems to determine the fate of relative paths (main/streams.c:1747). Note that this is *NOT* the same as the relative paths I mentioned above. /* Relative path open */ if (*filename == '.' && (IS_SLASH(filename[1]) || filename[1] == '.')) { /* further checks, we could have ....... filenames */ ptr = filename + 1; if (*ptr == '.') { while (*(++ptr) == '.'); if (!IS_SLASH(*ptr)) { /* not a relative path after all */ goto not_relative_path; } } if (php_check_open_basedir(filename TSRMLS_CC)) { return NULL; } if (PG(safe_mode) && (!php_checkuid(filename, mode, CHECKUID_CHECK_MODE_PARAM))) { return NULL; } return php_stream_fopen_rel(filename, mode, opened_path, options); } It looks to me like the include_path isn't even being checked here. Should the documentation explain that better? > Clearly the files is findable. And the manual does not explain why. It > only states that the scripts dir will not be searched. But, it does not > need to be for this unless I am missing something. -- Noel Forbes PHP Documentation Team