ID:               23696
 Updated by:       [EMAIL PROTECTED]
 Reported By:      veins at skreel dot org
-Status:           Open
+Status:           Bogus
 Bug Type:         *General Issues
 Operating System: Unix
 PHP Version:      4.3.1
 New Comment:

Thank you for taking the time to write to us, but this is not
a bug. Please double-check the documentation available at
http://www.php.net/manual/ and the instructions on how to report
a bug at http://bugs.php.net/how-to-report.php

 include("./file"); tries to open a file from the current directory,
while include("file"); will try to open file from any path listed in
include_path. One of those may very well match something you safe_mode
allows, hence the working include.


Previous Comments:
------------------------------------------------------------------------

[2003-05-22 09:18:59] veins at skreel dot org

i have played a bit with this issue and figured out the following:

still in my chrooted environement:
<? include("./file"); ?> triggers the safe_mode error

<? include("file"); ?> works when it should not

i am currently reading the sources but need some time to understand a
few things (lots of weird macros, lots of strange functions, and what
files do what)  :)

any help in fixing this issue will be greatly appreciated

------------------------------------------------------------------------

[2003-05-19 08:05:59] veins at skreel dot org

I am running apache in a chroot() and figured out yesterday that it
breaks the uid checks in safe mode.

>From what i understood, php *emulates* setuid scripts by checking
ownership of a file before accessing it from another. This could
theoritically be done by calling stat() on the file and checking the
st_uid field but for some reason, it appears that if the user database
is not in the chroot, php will fail the checks, to be more precise, the
check will always appear to be valid (i suspect this from being the
result of a comparison between two error values).

This means that:
<?
  include('someonesfile');  // will succeed

  echo getmyuid();          // the uid of owner of file
                            // not from apache's child
?>

since getmyuid() shows me the uid of owner of file, then it proves me
that uid of owner of file is successfully detected (stat() ?) and since
include() succeeds (unless i start copying all the user and group files
in chroot) despite the fact that the owner of 'someonesfile' is not
equal to value of getmyuid(), it makes me think that a getpw*()
function call is being used for some reason that I couldnt figure out
yet.

I didnt get a chance yet to look deep inside the source code since im
ill, so the reasons of why this happens are plain suppositions but the
problems occurs. Im sorry if I am not clear, mail me and I try explain
in a more clear way. I will try to get some free time this week to
figure this out since its quite annoying but maybe a developper could
explain brievely how the checks are done ?


------------------------------------------------------------------------


-- 
Edit this bug report at http://bugs.php.net/?id=23696&edit=1

Reply via email to