From: Bjorn dot Wiberg at its dot uu dot se
Operating system: IBM AIX 5.2.0.0 ML5
PHP version: 5.0.3
PHP Bug Type: Filesystem function related
Bug description: fopen() in cwd: filename must start with ./ under safe mode
Description:
------------
Under safe mode, if one tries to create a new file with fopen(),
specifying a filename without any path part in it (such as "./a.txt" or
/apache/htdocs/bwiberg/test/safemode/a.txt"), fopen() fails, claiming that
the file cannot be found.
If the file already exists, everything works just fine.
If you specify a path part ahead of the filename, everything works just
fine.
If you give fopen() "true" as a third argument, and make sure that your
include_path includes "." as its FIRST path (if you have several
directories in it), everything works just fine. (Perhaps the restriction
of only trying the FIRST path should be mentioned in the docs as well.)
I'm not sure if this problem is related to the earlier discussions of
php_realpath_hack (that fix should be present as "_AIX" is set by gcc
under AIX), but it sure poses a problem for scripts which rely on being
able to create a file in the current directory without specifying any
path.
Another question is why $handle in the example script isn't set to FALSE
if the open failed -- instead the error propagates to the fputs() part.
I'd appreciate any input regarding this. Thanks in advance!
Best regards,
Björn
Reproduce code:
---------------
<?php
print getcwd() . "<BR>";
$handle = fopen("a.txt", "w", false);
if ( $handle != FALSE ) {
fputs($handle, "testtext");
fclose($handle);
}
?>
Expected result:
----------------
/apache/htdocs/bwiberg/test/safemode
(File a.txt gets created in current directory.)
Actual result:
--------------
/apache/htdocs/bwiberg/test/safemode
Warning: fopen(): Unable to access a.txt in
/apache/htdocs/bwiberg/test/safemode/write.php on line 5 Warning:
fopen(a.txt): failed to open stream: No such file or directory in
/apache/htdocs/bwiberg/test/safemode/write.php on line 5
--
Edit bug report at http://bugs.php.net/?id=32503&edit=1
--
Try a CVS snapshot (php4): http://bugs.php.net/fix.php?id=32503&r=trysnapshot4
Try a CVS snapshot (php5.0):
http://bugs.php.net/fix.php?id=32503&r=trysnapshot50
Try a CVS snapshot (php5.1):
http://bugs.php.net/fix.php?id=32503&r=trysnapshot51
Fixed in CVS: http://bugs.php.net/fix.php?id=32503&r=fixedcvs
Fixed in release: http://bugs.php.net/fix.php?id=32503&r=alreadyfixed
Need backtrace: http://bugs.php.net/fix.php?id=32503&r=needtrace
Need Reproduce Script: http://bugs.php.net/fix.php?id=32503&r=needscript
Try newer version: http://bugs.php.net/fix.php?id=32503&r=oldversion
Not developer issue: http://bugs.php.net/fix.php?id=32503&r=support
Expected behavior: http://bugs.php.net/fix.php?id=32503&r=notwrong
Not enough info:
http://bugs.php.net/fix.php?id=32503&r=notenoughinfo
Submitted twice:
http://bugs.php.net/fix.php?id=32503&r=submittedtwice
register_globals: http://bugs.php.net/fix.php?id=32503&r=globals
PHP 3 support discontinued: http://bugs.php.net/fix.php?id=32503&r=php3
Daylight Savings: http://bugs.php.net/fix.php?id=32503&r=dst
IIS Stability: http://bugs.php.net/fix.php?id=32503&r=isapi
Install GNU Sed: http://bugs.php.net/fix.php?id=32503&r=gnused
Floating point limitations: http://bugs.php.net/fix.php?id=32503&r=float
No Zend Extensions: http://bugs.php.net/fix.php?id=32503&r=nozend
MySQL Configuration Error: http://bugs.php.net/fix.php?id=32503&r=mysqlcfg
