iliaa Fri Aug 4 20:31:42 2006 UTC
Modified files: (Branch: PHP_5_1)
/php-src/ext/imap php_imap.c
Log:
MFB: Fixed bug #37265 (Added missing safe_mode & open_basedir checks to
imap_body()).
http://cvs.php.net/viewvc.cgi/php-src/ext/imap/php_imap.c?r1=1.208.2.7&r2=1.208.2.8&diff_format=u
Index: php-src/ext/imap/php_imap.c
diff -u php-src/ext/imap/php_imap.c:1.208.2.7
php-src/ext/imap/php_imap.c:1.208.2.8
--- php-src/ext/imap/php_imap.c:1.208.2.7 Sat Jan 28 08:07:20 2006
+++ php-src/ext/imap/php_imap.c Fri Aug 4 20:31:41 2006
@@ -26,7 +26,7 @@
| PHP 4.0 updates: Zeev Suraski <[EMAIL PROTECTED]> |
+----------------------------------------------------------------------+
*/
-/* $Id: php_imap.c,v 1.208.2.7 2006/01/28 08:07:20 mike Exp $ */
+/* $Id: php_imap.c,v 1.208.2.8 2006/08/04 20:31:41 iliaa Exp $ */
#define IMAP41
@@ -761,6 +761,13 @@
efree(IMAPG(imap_password));
}
+ /* local filename, need to perform open_basedir and safe_mode checks */
+ if (Z_STRVAL_PP(mailbox)[0] != '{' &&
+ (php_check_open_basedir(Z_STRVAL_PP(mailbox) TSRMLS_CC)
||
+ (PG(safe_mode) && !php_checkuid(Z_STRVAL_PP(mailbox),
NULL, CHECKUID_CHECK_FILE_AND_DIR)))) {
+ RETURN_FALSE;
+ }
+
IMAPG(imap_user) = estrndup(Z_STRVAL_PP(user), Z_STRLEN_PP(user));
IMAPG(imap_password) = estrndup(Z_STRVAL_PP(passwd),
Z_STRLEN_PP(passwd));
--
PHP CVS Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
