diff options
| author | Ilia Alshanetsky <iliaa@php.net> | 2006-10-04 23:19:25 +0000 |
|---|---|---|
| committer | Ilia Alshanetsky <iliaa@php.net> | 2006-10-04 23:19:25 +0000 |
| commit | 9230cf3da61f904564df9d9dffaa4422950e2943 (patch) | |
| tree | a5f2fb5945e246e3c77092cbdb6486b3ff0c147c | |
| parent | dc22b7d4a5b7a6e134bd0fd06f7ac7fca0ca850a (diff) | |
| download | php-git-9230cf3da61f904564df9d9dffaa4422950e2943.tar.gz | |
Fixed missing open_basedir check inside chdir() function.
| -rw-r--r-- | NEWS | 1 | ||||
| -rw-r--r-- | ext/standard/dir.c | 2 |
2 files changed, 2 insertions, 1 deletions
@@ -7,6 +7,7 @@ PHP NEWS - Fixed mess with CGI/CLI -d option (now it works with cgi; constants are working exactly like in php.ini; with FastCGI -d affects all requests). (Dmitry) +- Fixed missing open_basedir check inside chdir() function. (Ilia) - Fixed bug #39035 (Compatibilty issue between DOM and zend.ze1_compatibility_mode). (Rob) - Fixed bug #39032 (strcspn() stops on null character). (Tony) diff --git a/ext/standard/dir.c b/ext/standard/dir.c index baa9a79c32..db70ba9afb 100644 --- a/ext/standard/dir.c +++ b/ext/standard/dir.c @@ -286,7 +286,7 @@ PHP_FUNCTION(chdir) RETURN_FALSE; } - if (PG(safe_mode) && !php_checkuid(str, NULL, CHECKUID_CHECK_FILE_AND_DIR)) { + if ((PG(safe_mode) && !php_checkuid(str, NULL, CHECKUID_CHECK_FILE_AND_DIR)) || php_check_open_basedir(str TSRMLS_CC)) { RETURN_FALSE; } ret = VCWD_CHDIR(str); |