diff options
| author | Ilia Alshanetsky <iliaa@php.net> | 2007-06-12 12:53:08 +0000 |
|---|---|---|
| committer | Ilia Alshanetsky <iliaa@php.net> | 2007-06-12 12:53:08 +0000 |
| commit | 06b4c66f024d1cba4880c8ebe2f8a39f48382913 (patch) | |
| tree | 2305a90e004f45333bb5eb4c34393f289fd1c150 /ext/standard/dir.c | |
| parent | 5160f532afb8cfe733a74246bafe02979356ad0b (diff) | |
| download | php-git-06b4c66f024d1cba4880c8ebe2f8a39f48382913.tar.gz | |
Fixed bug #41655 (open_basedir bypass via glob())
Diffstat (limited to 'ext/standard/dir.c')
| -rw-r--r-- | ext/standard/dir.c | 28 |
1 files changed, 17 insertions, 11 deletions
diff --git a/ext/standard/dir.c b/ext/standard/dir.c index 9159ac8d6e..7a7f4c4149 100644 --- a/ext/standard/dir.c +++ b/ext/standard/dir.c @@ -24,6 +24,7 @@ #include "fopen_wrappers.h" #include "file.h" #include "php_dir.h" +#include "php_string.h" #include "php_scandir.h" #ifdef HAVE_DIRENT_H @@ -361,7 +362,6 @@ PHP_NAMED_FUNCTION(php_if_readdir) Find pathnames matching a pattern */ PHP_FUNCTION(glob) { - char cwd[MAXPATHLEN]; int cwd_skip = 0; #ifdef ZTS char work_pattern[MAXPATHLEN]; @@ -395,6 +395,22 @@ PHP_FUNCTION(glob) } #endif + if (PG(safe_mode) || (PG(open_basedir) && *PG(open_basedir))) { + size_t base_len = php_dirname(pattern, strlen(pattern)); + char pos = pattern[base_len]; + + pattern[base_len] = '\0'; + + if (PG(safe_mode) && (!php_checkuid(pattern, NULL, CHECKUID_CHECK_FILE_AND_DIR))) { + RETURN_FALSE; + } + if (php_check_open_basedir(pattern TSRMLS_CC)) { + RETURN_FALSE; + } + + pattern[base_len] = pos; + } + globbuf.gl_offs = 0; if (0 != (ret = glob(pattern, flags & GLOB_FLAGMASK, NULL, &globbuf))) { #ifdef GLOB_NOMATCH @@ -420,16 +436,6 @@ PHP_FUNCTION(glob) return; } - /* we assume that any glob pattern will match files from one directory only - so checking the dirname of the first match should be sufficient */ - strlcpy(cwd, globbuf.gl_pathv[0], MAXPATHLEN); - if (PG(safe_mode) && (!php_checkuid(cwd, NULL, CHECKUID_CHECK_FILE_AND_DIR))) { - RETURN_FALSE; - } - if (php_check_open_basedir(cwd TSRMLS_CC)) { - RETURN_FALSE; - } - array_init(return_value); for (n = 0; n < globbuf.gl_pathc; n++) { /* we need to do this everytime since GLOB_ONLYDIR does not guarantee that |