diff options
| author | Ilia Alshanetsky <iliaa@php.net> | 2004-11-02 00:37:32 +0000 |
|---|---|---|
| committer | Ilia Alshanetsky <iliaa@php.net> | 2004-11-02 00:37:32 +0000 |
| commit | 5f9d72c4311d2e35898b3d87b7ea62f4c899da05 (patch) | |
| tree | e65274a24fbf6b065e3d24599c4275dec42a94b3 | |
| parent | e1dfbfc695812c4da9ea2e099b880597b2e56873 (diff) | |
| download | php-git-5f9d72c4311d2e35898b3d87b7ea62f4c899da05.tar.gz | |
Fixed open_basedir & safe_mode bypass inside readlink() function.
| -rw-r--r-- | ext/standard/link.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/ext/standard/link.c b/ext/standard/link.c index dca60529d9..ec67f19f51 100644 --- a/ext/standard/link.c +++ b/ext/standard/link.c @@ -65,6 +65,14 @@ PHP_FUNCTION(readlink) } convert_to_string_ex(filename); + if (PG(safe_mode) && !php_checkuid(Z_STRVAL_PP(filename), NULL, CHECKUID_CHECK_FILE_AND_DIR)) { + RETURN_FALSE; + } + + if (php_check_open_basedir(Z_STRVAL_PP(filename) TSRMLS_CC)) { + RETURN_FALSE; + } + ret = readlink(Z_STRVAL_PP(filename), buff, MAXPATHLEN-1); if (ret == -1) { |