iliaa           Sun May 21 16:32:10 2006 UTC

  Modified files:              
    /php-src/ext/curl   interface.c 
  Log:
  Added control character checks for cURL extension's open_basedir/safe_mode
  checks.
  
  
http://cvs.php.net/viewcvs.cgi/php-src/ext/curl/interface.c?r1=1.79&r2=1.80&diff_format=u
Index: php-src/ext/curl/interface.c
diff -u php-src/ext/curl/interface.c:1.79 php-src/ext/curl/interface.c:1.80
--- php-src/ext/curl/interface.c:1.79   Thu Apr 13 11:26:43 2006
+++ php-src/ext/curl/interface.c        Sun May 21 16:32:10 2006
@@ -16,7 +16,7 @@
    +----------------------------------------------------------------------+
 */
 
-/* $Id: interface.c,v 1.79 2006/04/13 11:26:43 tony2001 Exp $ */
+/* $Id: interface.c,v 1.80 2006/05/21 16:32:10 iliaa Exp $ */
 
 #define ZEND_INCLUDE_FULL_WINDOWS_HEADERS
 
@@ -161,11 +161,16 @@
            strncasecmp(str, "file:", sizeof("file:") - 1) == 0)                
                                                \
        {                                                                       
                                                                                
                                \
                php_url *tmp_url;                                               
                                                                                
                \
-                                                                               
                                                                                
                                \
+                                                                               
                                        \
                if (!(tmp_url = php_url_parse_ex(str, len))) {                  
                                                                \
                        php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid 
url '%s'", str);                           \
                        RETURN_FALSE;                                           
                                                                                
                \
                }                                                               
                                                                                
                                \
+                                                                               
                                        \
+               if (php_memnstr(str, tmp_url->path, strlen(tmp_url->path), str 
+ len)) {                                \
+                       php_error_docref(NULL TSRMLS_CC, E_WARNING, "Url '%s' 
contains unencoded control characters.", str);    \
+                       RETURN_FALSE;                                           
                                        \
+               }                                                               
                                        \
                                                                                
                                                                                
                                \
                if (tmp_url->query || tmp_url->fragment || 
php_check_open_basedir(tmp_url->path TSRMLS_CC)) { \
                        php_url_free(tmp_url);                                  
                                                                                
        \

-- 
PHP CVS Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php

Reply via email to