diff options
| author | Stanislav Malyshev <stas@php.net> | 2014-04-14 13:16:53 -0700 |
|---|---|---|
| committer | Stanislav Malyshev <stas@php.net> | 2014-04-14 13:35:59 -0700 |
| commit | 99b01fb3d7faf56fffa9285dcae9a6ed8dc0f440 (patch) | |
| tree | 635e8e11c0f2f6d0105db6a9dff445a728047fda /ext/session | |
| parent | 84fcc440838975c286649ee44c6f5257a95f2875 (diff) | |
| download | php-git-99b01fb3d7faf56fffa9285dcae9a6ed8dc0f440.tar.gz | |
ws fix
Diffstat (limited to 'ext/session')
| -rw-r--r-- | ext/session/mod_files.c | 24 |
1 files changed, 12 insertions, 12 deletions
diff --git a/ext/session/mod_files.c b/ext/session/mod_files.c index 76f5d4c7c6..e435246eb9 100644 --- a/ext/session/mod_files.c +++ b/ext/session/mod_files.c @@ -136,27 +136,27 @@ static void ps_files_open(ps_files *data, const char *key TSRMLS_DC) data->lastkey = estrdup(key); - /* O_NOFOLLOW to prevent us from following evil symlinks */ + /* O_NOFOLLOW to prevent us from following evil symlinks */ #ifdef O_NOFOLLOW - data->fd = VCWD_OPEN_MODE(buf, O_CREAT | O_RDWR | O_BINARY | O_NOFOLLOW, data->filemode); + data->fd = VCWD_OPEN_MODE(buf, O_CREAT | O_RDWR | O_BINARY | O_NOFOLLOW, data->filemode); #else - /* Check to make sure that the opened file is not outside of allowable dirs. - This is not 100% safe but it's hard to do something better without O_NOFOLLOW */ - if(PG(open_basedir) && lstat(buf, &sbuf) == 0 && S_ISLNK(sbuf.st_mode) && php_check_open_basedir(buf TSRMLS_CC)) { - return; - } - data->fd = VCWD_OPEN_MODE(buf, O_CREAT | O_RDWR | O_BINARY, data->filemode); + /* Check to make sure that the opened file is not outside of allowable dirs. + This is not 100% safe but it's hard to do something better without O_NOFOLLOW */ + if(PG(open_basedir) && lstat(buf, &sbuf) == 0 && S_ISLNK(sbuf.st_mode) && php_check_open_basedir(buf TSRMLS_CC)) { + return; + } + data->fd = VCWD_OPEN_MODE(buf, O_CREAT | O_RDWR | O_BINARY, data->filemode); #endif if (data->fd != -1) { #ifndef PHP_WIN32 - /* check that this session file was created by us or root – we - don't want to end up accepting the sessions of another webapp */ - if (fstat(data->fd, &sbuf) || (sbuf.st_uid != 0 && sbuf.st_uid != getuid() && sbuf.st_uid != geteuid())) { + /* check that this session file was created by us or root – we + don't want to end up accepting the sessions of another webapp */ + if (fstat(data->fd, &sbuf) || (sbuf.st_uid != 0 && sbuf.st_uid != getuid() && sbuf.st_uid != geteuid())) { close(data->fd); data->fd = -1; return; - } + } #endif flock(data->fd, LOCK_EX); |