CVS update: php4

Date: Tuesday June 15, 1999 @ 13:06 Author: ssb Update of /repository/php4 In directory php:/tmp/cvs-serv11919 Modified Files: cgi_main.c fopen-wrappers.c fopen-wrappers.h php_globals.h Log Message: * now using php4.ini instead of php3.ini * re-imported fopen-wrappers, fsock and string code from php3 NB! I have not tested all of the imported functions yet. Index: php4/cgi_main.c diff -u php4/cgi_main.c:1.17 php4/cgi_main.c:1.18 --- php4/cgi_main.c:1.17 Sat May 29 09:53:59 1999 +++ php4/cgi_main.c Tue Jun 15 13:06:21 1999 @@ -145,7 +145,7 @@ " -s Display colour syntax highlighted source.\n" " -f<file> Parse <file>. Implies `-q'\n" " -v Version number\n" - " -c<path> Look for php3.ini file in this directory\n" + " -c<path> Look for php4.ini file in this directory\n" #if SUPPORT_INTERACTIVE " -a Run interactively\n" #endif @@ -235,7 +235,7 @@ --disable-force-cgi-redirect switch. If you do this and you have your PHP CGI\n\ binary accessible somewhere in your web tree, people will be able to circumvent\n\ .htaccess security by loading files through the PHP parser. A good way around\n\ -this is to define doc_root in your php3.ini file to something other than your\n\ +this is to define doc_root in your php4.ini file to something other than your\n\ top-level DOCUMENT_ROOT. This way you can separate the part of your web space\n\n\ which uses PHP from the normal part using .htaccess security. If you do not have\n\ any .htaccess restrictions anywhere on your site you can leave doc_root undefined.\n\ Index: php4/fopen-wrappers.c diff -u php4/fopen-wrappers.c:1.12 php4/fopen-wrappers.c:1.13 --- php4/fopen-wrappers.c:1.12 Sun May 2 15:54:01 1999 +++ php4/fopen-wrappers.c Tue Jun 15 13:06:21 1999 @@ -2,7 +2,7 @@ +----------------------------------------------------------------------+ | PHP HTML Embedded Scripting Language Version 3.0 | +----------------------------------------------------------------------+ - | Copyright (c) 1997,1998 PHP Development Team (See Credits file) | + | Copyright (c) 1997-1999 PHP Development Team (See Credits file) | +----------------------------------------------------------------------+ | This program is free software; you can redistribute it and/or modify | | it under the terms of one of the following licenses: | @@ -27,7 +27,7 @@ | Jim Winstead <jimw@php.net> | +----------------------------------------------------------------------+ */ -/* $Id: fopen-wrappers.c,v 1.12 1999/05/02 19:54:01 zeev Exp $ */ +/* $Id: fopen-wrappers.c,v 1.13 1999/06/15 17:06:21 ssb Exp $ */ #include "php.h" #include "php_globals.h" @@ -51,7 +51,6 @@ #include "safe_mode.h" #include "php3_realpath.h" -#include "ext/standard/head.h" #include "ext/standard/php3_standard.h" #include "zend_compile.h" @@ -88,97 +87,128 @@ #include <sys/un.h> #endif -static FILE *php3_fopen_url_wrapper(const char *path, char *mode, int options, int *issock, int *socketd); +static FILE *php3_fopen_url_wrapper(char *path, char *mode, int options, int *issock, int *socketd); int _php3_getftpresult(int socketd); + /* When open_basedir is not NULL, check if the given filename is located in open_basedir. Returns -1 if error or not in the open_basedir, else 0 When open_basedir is NULL, always return 0 */ -PHPAPI int _php3_check_open_basedir(char *path) +PHPAPI int _php3_check_specific_open_basedir(char *basedir, char *path) { char resolved_name[MAXPATHLEN]; + char resolved_basedir[MAXPATHLEN]; char local_open_basedir[MAXPATHLEN]; int local_open_basedir_pos; - PLS_FETCH(); - /* Only check when open_basedir is available */ - if (PG(open_basedir) && *PG(open_basedir)) { - - /* Special case basedir==".": Use script-directory */ - if ((strcmp(PG(open_basedir), ".") == 0) && - request_info.filename && - *request_info.filename - ) { - strcpy(local_open_basedir, request_info.filename); - local_open_basedir_pos = strlen(local_open_basedir) - 1; + /* Special case basedir==".": Use script-directory */ + if ((strcmp(basedir, ".") == 0) && + request_info.filename && + *request_info.filename + ) { + strcpy(local_open_basedir, request_info.filename); + local_open_basedir_pos = strlen(local_open_basedir) - 1; - /* Strip filename */ + /* Strip filename */ + while (( +#if WIN32|WINNT + (local_open_basedir[local_open_basedir_pos] != '\\') || +#endif + (local_open_basedir[local_open_basedir_pos] != '/') + ) && + (local_open_basedir_pos >= 0) + ) { + local_open_basedir[local_open_basedir_pos--] = 0; + } +/* stripping unnecessary slashes is left + as an exercise to the underlying OS */ +#if 0 + /* Strip double (back)slashes */ + if (local_open_basedir_pos > 0) { while (( #if WIN32|WINNT - (local_open_basedir[local_open_basedir_pos] != '\\') || + (local_open_basedir[local_open_basedir_pos-1] == '\\') || #endif - (local_open_basedir[local_open_basedir_pos] != '/') + (local_open_basedir[local_open_basedir_pos-1] == '/') ) && - (local_open_basedir_pos >= 0) + (local_open_basedir_pos > 0) ) { local_open_basedir[local_open_basedir_pos--] = 0; } - -#if 0 - /* Strip double (back)slashes */ - if (local_open_basedir_pos > 0) { - while (( + } +#endif + } else { + /* Else use the unmodified path */ + strcpy(local_open_basedir, basedir); + } + + /* Resolve the real path into resolved_name */ + if ((_php3_realpath(path, resolved_name) != NULL) && (_php3_realpath(local_open_basedir, resolved_basedir) != NULL)) { + /* Check the path */ #if WIN32|WINNT - (local_open_basedir[local_open_basedir_pos-1] == '\\') || -#endif - (local_open_basedir[local_open_basedir_pos-1] == '/') - ) && - (local_open_basedir_pos > 0) - ) { - local_open_basedir[local_open_basedir_pos--] = 0; - } - } + if (strncasecmp(resolved_basedir, resolved_name, strlen(resolved_basedir)) == 0) { +#else + if (strncmp(resolved_basedir, resolved_name, strlen(resolved_basedir)) == 0) { #endif - + /* File is in the right directory */ + return 0; } else { - /* Else use the unmodified path */ - strcpy(local_open_basedir, PG(open_basedir)); + return -1; } - - /* Resolve the real path into resolved_name */ - if (_php3_realpath(path, resolved_name) != NULL) { - /* Check the path */ + } else { + /* Unable to resolve the real path, return -1 */ + return -1; + } +} + +PHPAPI int _php3_check_open_basedir(char *path) +{ + /* Only check when open_basedir is available */ + if (PG(open_basedir) && *PG(open_basedir)) { + char *pathbuf; + char *ptr; + char *end; + + pathbuf = estrdup(PG(open_basedir)); + + ptr = pathbuf; + + while (ptr && *ptr) { #if WIN32|WINNT - if (strncasecmp(local_open_basedir, resolved_name, strlen(local_open_basedir)) == 0) { + end = strchr(ptr, ';'); #else - if (strncmp(local_open_basedir, resolved_name, strlen(local_open_basedir)) == 0) { + end = strchr(ptr, ':'); #endif - /* File is in the right directory */ + if (end != NULL) { + *end = '\0'; + end++; + } + + if (_php3_check_specific_open_basedir(ptr, path) == 0) { + efree(pathbuf); return 0; - } else { - php3_error(E_WARNING, "open_basedir restriction in effect. File is in wrong directory."); - return -1; } - } else { - /* Unable to resolve the real path, return -1 */ - php3_error(E_WARNING, "open_basedir restriction in effect. Unable to verify location of file."); - return -1; + + ptr = end; } - } else { - /* open_basedir is not available, return 0 */ - return 0; + php3_error(E_WARNING, "open_basedir restriction in effect. File is in wrong directory."); + efree(pathbuf); + return -1; } + + /* Nothing to check... */ + return 0; } PHPAPI FILE *php3_fopen_wrapper(char *path, char *mode, int options, int *issock, int *socketd) { int cm=2; /* checkuid mode: 2 = if file does not exist, check directory */ - PLS_FETCH(); - + /* FIXME Lets not get in the habit of doing stuff like this. This should + be runtime enabled, NOT compile time. */ #if PHP3_URL_FOPEN if (!(options & IGNORE_URL)) { return php3_fopen_url_wrapper(path, mode, options, issock, socketd); @@ -199,17 +229,17 @@ #if CGI_BINARY || FHTTPD || USE_SAPI -PHPAPI FILE *php3_fopen_for_parser(void) +FILE *php3_fopen_for_parser(void) { FILE *fp; struct stat st; char *temp, *path_info, *fn; int l; PLS_FETCH(); - SLS_FETCH(); + fn = request_info.filename; - path_info = SG(request_info).request_uri; + path_info = request_info.path_info; #if HAVE_PWD_H if (PG(user_dir) && *PG(user_dir) && path_info && '/' == path_info[0] && '~' == path_info[1]) { @@ -280,17 +310,17 @@ fp = NULL; } if (!fp) { - php3_error(E_CORE_ERROR, "Unable to open %s", fn); + php3_error(E_ERROR, "Unable to open %s", fn); STR_FREE(request_info.filename); /* for same reason as above */ return NULL; } - - temp = estrdup(fn); + _php3_hash_index_update(&include_names, 0, (void *) &fn, sizeof(char *), NULL); + + temp = strdup(fn); _php3_dirname(temp, strlen(temp)); - if (*temp) { + if (*temp) chdir(temp); - } - efree(temp); + free(temp); return fp; } @@ -417,7 +447,7 @@ * Otherwise, fopen is called as usual and the file pointer is returned. */ -static FILE *php3_fopen_url_wrapper(const char *path, char *mode, int options, int *issock, int *socketd) +static FILE *php3_fopen_url_wrapper(char *path, char *mode, int options, int *issock, int *socketd) { url *resource; int result; @@ -443,10 +473,9 @@ FILE *fp = NULL; struct sockaddr_in server; unsigned short portno; - char winfeof; if (!strncasecmp(path, "http://", 7)) { - resource = url_parse((char *) path); + resource = url_parse(path); if (resource == NULL) { php3_error(E_WARNING, "Invalid URL specified, %s", path); *issock = BAD_URL; @@ -463,9 +492,9 @@ free_url(resource); return NULL; } - lookup_hostname(resource->host, &server.sin_addr); + server.sin_family = AF_INET; - if (server.sin_addr.s_addr == -1) { + if (lookup_hostname(resource->host, &server.sin_addr)) { SOCK_FCLOSE(*socketd); *socketd = 0; free_url(resource); @@ -553,8 +582,8 @@ /* Read past http header */ body = 0; location[0] = '\0'; - while (!body && recv(*socketd, (char *) &winfeof, 1, MSG_PEEK)) { - if (SOCK_FGETC(buf, *socketd) == SOCK_RECV_ERR) { + while (!body && !SOCK_FEOF(*socketd)) { + if ((buf[0] = SOCK_FGETC(*socketd)) == EOF) { SOCK_FCLOSE(*socketd); *socketd = 0; free_url(resource); @@ -606,7 +635,7 @@ *issock = 1; return (fp); } else if (!strncasecmp(path, "ftp://", 6)) { - resource = url_parse((char *) path); + resource = url_parse(path); if (resource == NULL) { php3_error(E_WARNING, "Invalid URL specified, %s", path); *issock = BAD_URL; @@ -628,9 +657,9 @@ free_url(resource); return NULL; } - lookup_hostname(resource->host, &server.sin_addr); + server.sin_family = AF_INET; - if (server.sin_addr.s_addr == -1) { + if (lookup_hostname(resource->host, &server.sin_addr)) { SOCK_FCLOSE(*socketd); *socketd = 0; free_url(resource); @@ -840,9 +869,9 @@ free_url(resource); return NULL; } - lookup_hostname(resource->host, &server.sin_addr); + server.sin_family = AF_INET; - if (server.sin_addr.s_addr == -1) { + if (lookup_hostname(resource->host, &server.sin_addr)) { free_url(resource); SOCK_FCLOSE(*socketd); *socketd = 0; @@ -881,17 +910,15 @@ return (fp); } else { - PLS_FETCH(); - if (options & USE_PATH) { - fp = php3_fopen_with_path((char *) path, mode, PG(include_path), NULL); + fp = php3_fopen_with_path(path, mode, PG(include_path), NULL); } else { int cm=2; if(!strcmp(mode,"r") || !strcmp(mode,"r+")) cm=0; if (options & ENFORCE_SAFE_MODE && PG(safe_mode) && (!_php3_checkuid(path, cm))) { fp = NULL; } else { - if (_php3_check_open_basedir((char *) path)) { + if (_php3_check_open_basedir(path)) { fp = NULL; } else { fp = fopen(path, mode); Index: php4/fopen-wrappers.h diff -u php4/fopen-wrappers.h:1.2 php4/fopen-wrappers.h:1.3 --- php4/fopen-wrappers.h:1.2 Mon Apr 26 10:00:46 1999 +++ php4/fopen-wrappers.h Tue Jun 15 13:06:21 1999 @@ -2,7 +2,7 @@ +----------------------------------------------------------------------+ | PHP HTML Embedded Scripting Language Version 3.0 | +----------------------------------------------------------------------+ - | Copyright (c) 1997,1998 PHP Development Team (See Credits file) | + | Copyright (c) 1997-1999 PHP Development Team (See Credits file) | +----------------------------------------------------------------------+ | This program is free software; you can redistribute it and/or modify | | it under the terms of one of the following licenses: | @@ -26,7 +26,7 @@ | Authors: Jim Winstead <jimw@php.net> | +----------------------------------------------------------------------+ */ -/* $Id: fopen-wrappers.h,v 1.2 1999/04/26 14:00:46 zeev Exp $ */ +/* $Id: fopen-wrappers.h,v 1.3 1999/06/15 17:06:21 ssb Exp $ */ #ifndef _FOPEN_WRAPPERS_H #define _FOPEN_WRAPPERS_H @@ -46,17 +46,18 @@ # define SOCK_ERR INVALID_SOCKET # define SOCK_CONN_ERR SOCKET_ERROR # define SOCK_RECV_ERR SOCKET_ERROR -# define SOCK_FCLOSE(s) closesocket(s) #else # define SOCK_ERR -1 # define SOCK_CONN_ERR -1 # define SOCK_RECV_ERR -1 -# define SOCK_FCLOSE(s) close(s) #endif #define SOCK_WRITE(d,s) send(s,d,strlen(d),0) #define SOCK_WRITEL(d,l,s) send(s,d,l,0) -#define SOCK_FGETC(c,s) recv(s,c,1,0) +#define SOCK_FGETC(s) _php3_sock_fgetc((s)) #define SOCK_FGETS(b,l,s) _php3_sock_fgets((b),(l),(s)) +#define SOCK_FEOF(sock) _php3_sock_feof((sock)) +#define SOCK_FREAD(ptr,size,sock) _php3_sock_fread((ptr),(size),(sock)) +#define SOCK_FCLOSE(s) _php3_sock_close(s) /* values for issock */ #define IS_NOT_SOCKET 0 @@ -69,15 +70,15 @@ extern PHPAPI FILE *php3_fopen_wrapper(char *filename, char *mode, int options, int *issock, int *socketd); -PHPAPI FILE *php3_fopen_for_parser(void); +extern FILE *php3_fopen_for_parser(void); extern PHPAPI int _php3_check_open_basedir(char *path); +extern PHPAPI int _php3_check_specific_open_basedir(char *basedir, char *path); extern PHPAPI FILE *php3_fopen_with_path(char *filename, char *mode, char *path, char **opened_path); extern PHPAPI int php3_isurl(char *path); extern PHPAPI char *php3_strip_url_passwd(char *path); -extern PHPAPI int php3_write(void *buf, int size); extern PHPAPI char *expand_filepath(char *filepath); Index: php4/php_globals.h diff -u php4/php_globals.h:1.14 php4/php_globals.h:1.15 --- php4/php_globals.h:1.14 Fri Jun 4 06:45:53 1999 +++ php4/php_globals.h Tue Jun 15 13:06:21 1999 @@ -29,13 +29,13 @@ long magic_quotes_runtime; long magic_quotes_sybase; - long asp_tags; - long short_tags; + long asp_tags; + long short_tags; - long safe_mode; - long sql_safe_mode; - char *safe_mode_exec_dir; - long enable_dl; + long safe_mode; + long sql_safe_mode; + char *safe_mode_exec_dir; + long enable_dl; long memory_limit; @@ -47,11 +47,11 @@ char *doc_root; char *user_dir; char *include_path; - char *open_basedir; + char *open_basedir; char *extension_dir; char *upload_tmp_dir; - long upload_max_filesize; + long upload_max_filesize; char *auto_prepend_file; char *auto_append_file; @@ -63,8 +63,15 @@ long y2k_compliance; - unsigned char header_is_being_sent; + unsigned char header_is_being_sent; }; #endif /* _PHP_GLOBALS_H */ + +/* + * Local variables: + * tab-width: 4 + * c-basic-offset: 4 + * End: + */