iliaa Sun May 21 16:32:10 2006 UTC Modified files: /php-src/ext/curl interface.c Log: Added control character checks for cURL extension's open_basedir/safe_mode checks. http://cvs.php.net/viewcvs.cgi/php-src/ext/curl/interface.c?r1=1.79&r2=1.80&diff_format=u Index: php-src/ext/curl/interface.c diff -u php-src/ext/curl/interface.c:1.79 php-src/ext/curl/interface.c:1.80 --- php-src/ext/curl/interface.c:1.79 Thu Apr 13 11:26:43 2006 +++ php-src/ext/curl/interface.c Sun May 21 16:32:10 2006 @@ -16,7 +16,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: interface.c,v 1.79 2006/04/13 11:26:43 tony2001 Exp $ */ +/* $Id: interface.c,v 1.80 2006/05/21 16:32:10 iliaa Exp $ */ #define ZEND_INCLUDE_FULL_WINDOWS_HEADERS @@ -161,11 +161,16 @@ strncasecmp(str, "file:", sizeof("file:") - 1) == 0) \ { \ php_url *tmp_url; \ - \ + \ if (!(tmp_url = php_url_parse_ex(str, len))) { \ php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid url '%s'", str); \ RETURN_FALSE; \ } \ + \ + if (php_memnstr(str, tmp_url->path, strlen(tmp_url->path), str + len)) { \ + php_error_docref(NULL TSRMLS_CC, E_WARNING, "Url '%s' contains unencoded control characters.", str); \ + RETURN_FALSE; \ + } \ \ if (tmp_url->query || tmp_url->fragment || php_check_open_basedir(tmp_url->path TSRMLS_CC)) { \ php_url_free(tmp_url); \
-- PHP CVS Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php