diff options
| -rw-r--r-- | NEWS | 4 | ||||
| -rw-r--r-- | ext/standard/file.c | 4 |
2 files changed, 8 insertions, 0 deletions
@@ -8,6 +8,10 @@ - Implemented FR #49253 (added support for libcurl's CERTINFO option). (Linus Nielsen Feltzing <linus@haxx.se>) +- Fixed a safe_mode bypass in tempnam() identified by Grzegorz Stachowiak. + (Rasmus) +- Fixed a open_basedir bypass in posix_mkfifo() identified by Grzegorz + Stachowiak. (Rasmus) - Fixed bug #49698 (Unexpected change in strnatcasecmp()). (Rasmus) - Fixed bug #49647 (DOMUserData does not exist). (Rob) - Fixed bug #49630 (imap_listscan function missing). (Felipe) diff --git a/ext/standard/file.c b/ext/standard/file.c index afaae796da..387bbc3220 100644 --- a/ext/standard/file.c +++ b/ext/standard/file.c @@ -846,6 +846,10 @@ PHP_FUNCTION(tempnam) return; } + if (PG(safe_mode) &&(!php_checkuid(dir, NULL, CHECKUID_ALLOW_ONLY_DIR))) { + RETURN_FALSE; + } + if (php_check_open_basedir(dir TSRMLS_CC)) { RETURN_FALSE; } |