iliaa Fri Aug 4 20:31:19 2006 UTC
Modified files: (Branch: PHP_5_2)
/php-src/ext/imap php_imap.c
/php-src NEWS
Log:
Fixed bug #37265 (Added missing safe_mode & open_basedir checks to
imap_body()).
http://cvs.php.net/viewvc.cgi/php-src/ext/imap/php_imap.c?r1=1.208.2.7.2.1&r2=1.208.2.7.2.2&diff_format=u
Index: php-src/ext/imap/php_imap.c
diff -u php-src/ext/imap/php_imap.c:1.208.2.7.2.1
php-src/ext/imap/php_imap.c:1.208.2.7.2.2
--- php-src/ext/imap/php_imap.c:1.208.2.7.2.1 Thu Jun 15 18:33:07 2006
+++ php-src/ext/imap/php_imap.c Fri Aug 4 20:31:19 2006
@@ -26,7 +26,7 @@
| PHP 4.0 updates: Zeev Suraski <[EMAIL PROTECTED]> |
+----------------------------------------------------------------------+
*/
-/* $Id: php_imap.c,v 1.208.2.7.2.1 2006/06/15 18:33:07 dmitry Exp $ */
+/* $Id: php_imap.c,v 1.208.2.7.2.2 2006/08/04 20:31:19 iliaa Exp $ */
#define IMAP41
@@ -763,6 +763,13 @@
efree(IMAPG(imap_password));
}
+ /* local filename, need to perform open_basedir and safe_mode checks */
+ if (Z_STRVAL_PP(mailbox)[0] != '{' &&
+ (php_check_open_basedir(Z_STRVAL_PP(mailbox) TSRMLS_CC)
||
+ (PG(safe_mode) && !php_checkuid(Z_STRVAL_PP(mailbox),
NULL, CHECKUID_CHECK_FILE_AND_DIR)))) {
+ RETURN_FALSE;
+ }
+
IMAPG(imap_user) = estrndup(Z_STRVAL_PP(user), Z_STRLEN_PP(user));
IMAPG(imap_password) = estrndup(Z_STRVAL_PP(passwd),
Z_STRLEN_PP(passwd));
http://cvs.php.net/viewvc.cgi/php-src/NEWS?r1=1.2027.2.547.2.182&r2=1.2027.2.547.2.183&diff_format=u
Index: php-src/NEWS
diff -u php-src/NEWS:1.2027.2.547.2.182 php-src/NEWS:1.2027.2.547.2.183
--- php-src/NEWS:1.2027.2.547.2.182 Fri Aug 4 11:50:15 2006
+++ php-src/NEWS Fri Aug 4 20:31:19 2006
@@ -76,6 +76,8 @@
compatibility issue). (Jani, patch by scott dot moynes+php at gmail dot com)
- Fixed bug #37445 (Fixed crash in pdo_mysql resulting from premature object
destruction). (Ilia)
+- Fixed bug #37265 (Added missing safe_mode & open_basedir checks to
+ imap_body()). (Ilia)
24 Jul 2006, PHP 5.2.0RC1
- Updated bundled MySQL client library to version 5.0.22 in the Windows
--
PHP CVS Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
