diff options
| author | Ilia Alshanetsky <iliaa@php.net> | 2006-12-09 16:01:29 +0000 |
|---|---|---|
| committer | Ilia Alshanetsky <iliaa@php.net> | 2006-12-09 16:01:29 +0000 |
| commit | 0236a7eaf4e6ae45cef81a2cfbff28ce4139d2b2 (patch) | |
| tree | 1ca676df2d438e8751bce961d280b0e9a331f0a9 /ext | |
| parent | 3d5fec9cb562e77990462515a303cf143ad737b8 (diff) | |
| download | php-git-0236a7eaf4e6ae45cef81a2cfbff28ce4139d2b2.tar.gz | |
Fixed bug #29840 (is_executable() does not honor safe_mode_exec_dir
setting).
Diffstat (limited to 'ext')
| -rw-r--r-- | ext/standard/filestat.c | 15 |
1 files changed, 14 insertions, 1 deletions
diff --git a/ext/standard/filestat.c b/ext/standard/filestat.c index 5e98cc412e..0c113a3879 100644 --- a/ext/standard/filestat.c +++ b/ext/standard/filestat.c @@ -684,14 +684,27 @@ PHPAPI void php_stat(const char *filename, php_stat_len filename_length, int typ "size", "atime", "mtime", "ctime", "blksize", "blocks"}; char *local; php_stream_wrapper *wrapper; + char safe_mode_buf[MAXPATHLEN]; if (!filename_length) { RETURN_FALSE; } if ((wrapper = php_stream_locate_url_wrapper(filename, &local, 0 TSRMLS_CC)) == &php_plain_files_wrapper) { - if (php_check_open_basedir(local TSRMLS_CC) || (PG(safe_mode) && !php_checkuid_ex(filename, NULL, CHECKUID_ALLOW_FILE_NOT_EXISTS, CHECKUID_NO_ERRORS))) { + if (php_check_open_basedir(local TSRMLS_CC)) { RETURN_FALSE; + } else if (PG(safe_mode)) { + if (type == FS_IS_X) { + if (strstr(local, "..")) { + RETURN_FALSE; + } else { + char *b = strrchr(local, PHP_DIR_SEPARATOR); + snprintf(safe_mode_buf, MAXPATHLEN, "%s%s%s", PG(safe_mode_exec_dir), (b ? "" : "/"), (b ? b : local)); + local = (char *)&safe_mode_buf; + } + } else if (!php_checkuid_ex(local, NULL, CHECKUID_ALLOW_FILE_NOT_EXISTS, CHECKUID_NO_ERRORS)) { + RETURN_FALSE; + } } } |