iliaa Fri Aug 4 20:32:45 2006 UTC
Modified files: (Branch: PHP_4_4)
/php-src/ext/imap php_imap.c
/php-src NEWS
Log:
MFB: Fixed bug #37265 (Added missing safe_mode & open_basedir checks to
imap_body()).
http://cvs.php.net/viewvc.cgi/php-src/ext/imap/php_imap.c?r1=1.142.2.44.2.4&r2=1.142.2.44.2.5&diff_format=u
Index: php-src/ext/imap/php_imap.c
diff -u php-src/ext/imap/php_imap.c:1.142.2.44.2.4
php-src/ext/imap/php_imap.c:1.142.2.44.2.5
--- php-src/ext/imap/php_imap.c:1.142.2.44.2.4 Thu Jan 5 00:50:19 2006
+++ php-src/ext/imap/php_imap.c Fri Aug 4 20:32:44 2006
@@ -26,7 +26,7 @@
| PHP 4.0 updates: Zeev Suraski <[EMAIL PROTECTED]> |
+----------------------------------------------------------------------+
*/
-/* $Id: php_imap.c,v 1.142.2.44.2.4 2006/01/05 00:50:19 iliaa Exp $ */
+/* $Id: php_imap.c,v 1.142.2.44.2.5 2006/08/04 20:32:44 iliaa Exp $ */
#define IMAP41
@@ -731,6 +731,13 @@
efree(IMAPG(imap_password));
}
+ /* local filename, need to perform open_basedir and safe_mode checks */
+ if (Z_STRVAL_PP(mailbox)[0] != '{' &&
+ (php_check_open_basedir(Z_STRVAL_PP(mailbox) TSRMLS_CC)
||
+ (PG(safe_mode) && !php_checkuid(Z_STRVAL_PP(mailbox),
NULL, CHECKUID_CHECK_FILE_AND_DIR)))) {
+ RETURN_FALSE;
+ }
+
IMAPG(imap_user) = estrndup(Z_STRVAL_PP(user), Z_STRLEN_PP(user));
IMAPG(imap_password) = estrndup(Z_STRVAL_PP(passwd),
Z_STRLEN_PP(passwd));
http://cvs.php.net/viewvc.cgi/php-src/NEWS?r1=1.1247.2.920.2.148&r2=1.1247.2.920.2.149&diff_format=u
Index: php-src/NEWS
diff -u php-src/NEWS:1.1247.2.920.2.148 php-src/NEWS:1.1247.2.920.2.149
--- php-src/NEWS:1.1247.2.920.2.148 Fri Aug 4 11:59:50 2006
+++ php-src/NEWS Fri Aug 4 20:32:44 2006
@@ -9,6 +9,8 @@
- Fixed bug #38183 (disable_classes=Foobar causes disabled class to be
called Foo). (Jani)
- Fixed bug #38112 (corrupted gif segfaults) (Pierre)
+- Fixed bug #37265 (Added missing safe_mode & open_basedir checks to
+ imap_body()). (Ilia)
- Fixed bug #29538 (number_format and problem with 0). (Matthew Wilmas)
03 Aug 2006, Version 4.4.3
--
PHP CVS Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
