cvs: /php4 php.ini-dist /php4/ext/standard basic_functions.c basic_functions.h

zeev Sun Jan 30 23:11:00 2000 EDT Modified files: /php4 php.ini-dist /php4/ext/standard basic_functions.c basic_functions.h Log: @- Added the ability to prevent the user from overriding certain environment @ variables in Safe Mode (Zeev) - Finished work, more or less Index: php4/php.ini-dist diff -u php4/php.ini-dist:1.20 php4/php.ini-dist:1.21 --- php4/php.ini-dist:1.20 Fri Jan 28 19:29:37 2000 +++ php4/php.ini-dist Sun Jan 30 23:10:30 2000 @@ -77,6 +77,12 @@ ; Safe Mode safe_mode = Off safe_mode_exec_dir = +safe_mode_protected_env_vars = LD_LIBRARY_PATH ; In Safe Mode, setting certain environment + ; variables may be a potential security + ; breach. This directive contains + ; a comma delimited list of environment + ; variables, that the end user won't be + ; able to override using putenv() ; Colors for Syntax Highlighting mode. Anything that's acceptable in <font color=???> would work. highlight.string = #DD0000 Index: php4/ext/standard/basic_functions.c diff -u php4/ext/standard/basic_functions.c:1.151 php4/ext/standard/basic_functions.c:1.152 --- php4/ext/standard/basic_functions.c:1.151 Sun Jan 30 21:49:16 2000 +++ php4/ext/standard/basic_functions.c Sun Jan 30 23:10:30 2000 @@ -316,8 +316,10 @@ protected_vars = estrndup(new_value, new_value_length); zend_hash_clean(&BG(protected_env_vars)); - while (protected_var=strtok(protected_vars, ",")) { + protected_var=strtok(protected_vars, ", "); + while (protected_var) { zend_hash_update(&BG(protected_env_vars), protected_var, strlen(protected_var), &dummy, sizeof(int), NULL); + protected_var=strtok(NULL, ", "); } efree(protected_vars); return SUCCESS; @@ -545,6 +547,14 @@ pe.key_len = strlen(pe.key); pe.key = estrndup(pe.key,pe.key_len); + if (PG(safe_mode) + && zend_hash_exists(&BG(protected_env_vars), pe.key, pe.key_len)) { + php_error(E_WARNING, "Safe Mode: Cannot override protected environment variable '%s'", pe.key); + efree(pe.putenv_string); + efree(pe.key); + RETURN_FALSE; + } + zend_hash_del(&BG(putenv_ht),pe.key,pe.key_len+1); /* find previous value */ Index: php4/ext/standard/basic_functions.h diff -u php4/ext/standard/basic_functions.h:1.41 php4/ext/standard/basic_functions.h:1.42 --- php4/ext/standard/basic_functions.h:1.41 Sun Jan 30 21:49:16 2000 +++ php4/ext/standard/basic_functions.h Sun Jan 30 23:10:30 2000 @@ -29,7 +29,7 @@ */ -/* $Id: basic_functions.h,v 1.41 2000/01/30 20:49:16 zeev Exp $ */ +/* $Id: basic_functions.h,v 1.42 2000/01/30 22:10:30 zeev Exp $ */ #ifndef _BASIC_FUNCTIONS_H #define _BASIC_FUNCTIONS_H @@ -184,6 +184,6 @@ /* Values are coma-delimited */ -#define SAFE_MODE_PROTECTED_ENV_VARS "LD_" +#define SAFE_MODE_PROTECTED_ENV_VARS "LD_LIBRARY_PATH" #endif /* _BASIC_FUNCTIONS_H */