diff options
| author | Ilia Alshanetsky <iliaa@php.net> | 2006-09-27 23:44:13 +0000 |
|---|---|---|
| committer | Ilia Alshanetsky <iliaa@php.net> | 2006-09-27 23:44:13 +0000 |
| commit | 5860f471222a71e6283d23dbe4d736a27106e9a9 (patch) | |
| tree | e83fb7d6c16790be572e41f497b53bbcb14c8170 | |
| parent | 47600225e11f919470e278a2043072c985e647ba (diff) | |
| download | php-git-5860f471222a71e6283d23dbe4d736a27106e9a9.tar.gz | |
Fixed bug #38963 (Fixed a possible open_basedir bypass in tempnam()).
| -rw-r--r-- | NEWS | 1 | ||||
| -rw-r--r-- | main/php_open_temporary_file.c | 11 |
2 files changed, 11 insertions, 1 deletions
@@ -8,6 +8,7 @@ PHP NEWS (Dmitry) - Fixed bug #38961 (metaphone() results in segmentation fault on NetBSD). (Tony) +- Fixed bug #38963 (Fixed a possible open_basedir bypass in tempnam()). (Ilia) - Fixed bug #38949 (Cannot get xmlns value attribute). (Rob) - Fixed bug #38942 (Double old-style-ctor inheritance). (Dmitry) - Fixed bug #38941 (imap extension does not compile against new version of diff --git a/main/php_open_temporary_file.c b/main/php_open_temporary_file.c index b2e27e2f79..60526fa0e4 100644 --- a/main/php_open_temporary_file.c +++ b/main/php_open_temporary_file.c @@ -206,6 +206,7 @@ PHPAPI const char* php_get_temporary_directory(void) PHPAPI int php_open_temporary_fd(const char *dir, const char *pfx, char **opened_path_p TSRMLS_DC) { int fd; + char *temp_dir = php_get_temporary_directory(); if (!pfx) { pfx = "tmp."; @@ -214,11 +215,19 @@ PHPAPI int php_open_temporary_fd(const char *dir, const char *pfx, char **opened *opened_path_p = NULL; } + if (!dir || *dir == '\0') { + if (temp_dir && *temp_dir != '\0' && !php_check_open_basedir(temp_dir TSRMLS_CC)) { + return php_do_open_temporary_file(temp_dir, pfx, opened_path_p TSRMLS_CC); + } else { + return -1; + } + } + /* Try the directory given as parameter. */ fd = php_do_open_temporary_file(dir, pfx, opened_path_p TSRMLS_CC); if (fd == -1) { /* Use default temporary directory. */ - fd = php_do_open_temporary_file(php_get_temporary_directory(), pfx, opened_path_p TSRMLS_CC); + fd = php_do_open_temporary_file(temp_dir, pfx, opened_path_p TSRMLS_CC); } return fd; } |