diff options
| author | Anatol Belski <ab@php.net> | 2016-02-14 20:49:03 +0100 |
|---|---|---|
| committer | Anatol Belski <ab@php.net> | 2016-02-14 20:49:03 +0100 |
| commit | 724ee191115dcb2389b38a94a963574581bf54c2 (patch) | |
| tree | 8b81ca9bc5986d3765f08a27fcd6e7a310f53027 /sapi/cli/php_cli_server.c | |
| parent | 9bef2212aa0f4a9b615c3feaa8b899f96af6108d (diff) | |
| parent | ce4a2f0fc60309f429e4c04160a71befc283338a (diff) | |
| download | php-git-724ee191115dcb2389b38a94a963574581bf54c2.tar.gz | |
Merge branch 'PHP-5.6' into PHP-7.0
* PHP-5.6:
Fixed bug #71559 Built-in HTTP server, we can downlaod file in web by bug
Diffstat (limited to 'sapi/cli/php_cli_server.c')
| -rw-r--r-- | sapi/cli/php_cli_server.c | 13 |
1 files changed, 13 insertions, 0 deletions
diff --git a/sapi/cli/php_cli_server.c b/sapi/cli/php_cli_server.c index 4ee85bf538..ac41c44def 100644 --- a/sapi/cli/php_cli_server.c +++ b/sapi/cli/php_cli_server.c @@ -1955,6 +1955,19 @@ static int php_cli_server_begin_send_static(php_cli_server *server, php_cli_serv return php_cli_server_send_error_page(server, client, 400); } +#ifdef PHP_WIN32 + /* The win32 namespace will cut off trailing dots and spaces. Since the + VCWD functionality isn't used here, a sophisticated functionality + would have to be reimplemented to know ahead there are no files + with invalid names there. The simplest is just to forbid invalid + filenames, which is done here. */ + if (client->request.path_translated && + ('.' == client->request.path_translated[client->request.path_translated_len-1] || + ' ' == client->request.path_translated[client->request.path_translated_len-1])) { + return php_cli_server_send_error_page(server, client, 500); + } +#endif + fd = client->request.path_translated ? open(client->request.path_translated, O_RDONLY): -1; if (fd < 0) { return php_cli_server_send_error_page(server, client, 404); |