pajoye Wed Mar 14 11:22:13 2007 UTC
Modified files:
/php-src/ext/zip php_zip.h php_zip.c zip_stream.c
Log:
- MFB:
- rename SAFEMODE_CHECKFILE to OPENBASEDIR_CHECKPATH (can be used without
confusing in head without confusion)
- Add safemode and open basedir checks in zip:// wrapper (revert Ilia's
patch). Bug found by Stefan Esser in his MOPB-20-2007
http://cvs.php.net/viewvc.cgi/php-src/ext/zip/php_zip.h?r1=1.14&r2=1.15&diff_format=u
Index: php-src/ext/zip/php_zip.h
diff -u php-src/ext/zip/php_zip.h:1.14 php-src/ext/zip/php_zip.h:1.15
--- php-src/ext/zip/php_zip.h:1.14 Mon Jan 1 09:29:34 2007
+++ php-src/ext/zip/php_zip.h Wed Mar 14 11:22:13 2007
@@ -16,7 +16,7 @@
+----------------------------------------------------------------------+
*/
-/* $Id: php_zip.h,v 1.14 2007/01/01 09:29:34 sebastian Exp $ */
+/* $Id: php_zip.h,v 1.15 2007/03/14 11:22:13 pajoye Exp $ */
#ifndef PHP_ZIP_H
#define PHP_ZIP_H
@@ -30,6 +30,16 @@
#include "lib/zip.h"
+/* {{{ OPENBASEDIR_CHECKPATH(filename) */
+#if (PHP_MAJOR_VERSION < 6)
+#define OPENBASEDIR_CHECKPATH(filename) \
+ (PG(safe_mode) && (!php_checkuid(filename, NULL,
CHECKUID_CHECK_FILE_AND_DIR))) || php_check_open_basedir(filename TSRMLS_CC)
+#else
+#define OPENBASEDIR_CHECKPATH(filename) \
+ php_check_open_basedir(filename TSRMLS_CC)
+#endif
+/* }}} */
+
typedef struct _ze_zip_rsrc {
struct zip *za;
int index_current;
http://cvs.php.net/viewvc.cgi/php-src/ext/zip/php_zip.c?r1=1.38&r2=1.39&diff_format=u
Index: php-src/ext/zip/php_zip.c
diff -u php-src/ext/zip/php_zip.c:1.38 php-src/ext/zip/php_zip.c:1.39
--- php-src/ext/zip/php_zip.c:1.38 Mon Jan 29 16:01:55 2007
+++ php-src/ext/zip/php_zip.c Wed Mar 14 11:22:13 2007
@@ -16,7 +16,7 @@
+----------------------------------------------------------------------+
*/
-/* $Id: php_zip.c,v 1.38 2007/01/29 16:01:55 pajoye Exp $ */
+/* $Id: php_zip.c,v 1.39 2007/03/14 11:22:13 pajoye Exp $ */
#ifdef HAVE_CONFIG_H
#include "config.h"
@@ -122,6 +122,11 @@
}
php_basename(file, file_len, NULL, 0, &file_basename, (unsigned
int *)&file_basename_len TSRMLS_CC);
+ if (OPENBASEDIR_CHECKPATH(file_dirname_fullpath)) {
+ efree(file_dirname_fullpath);
+ efree(file_basename);
+ return 0;
+ }
}
/* let see if the path already exists */
if (php_stream_stat_path(file_dirname_fullpath, &ssb) < 0) {
@@ -149,6 +154,16 @@
return 0;
}
+ /* check again the full path, not sure if it
+ * is required, does a file can have a different
+ * safemode status as its parent folder?
+ */
+ if (OPENBASEDIR_CHECKPATH(fullpath)) {
+ efree(file_dirname_fullpath);
+ efree(file_basename);
+ return 0;
+ }
+
zf = zip_fopen(za, file, 0);
if (zf == NULL) {
efree(fullpath);
@@ -609,6 +624,9 @@
if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "Z",
&filename_zval) == FAILURE) {
return;
}
+ if (OPENBASEDIR_CHECKPATH(filename)) {
+ RETURN_FALSE;
+ }
if (FAILURE == php_stream_path_param_encode(filename_zval, &filename,
&filename_len, REPORT_ERRORS, FG(default_context))) {
RETURN_FALSE;
@@ -2083,7 +2101,7 @@
php_info_print_table_start();
php_info_print_table_row(2, "Zip", "enabled");
- php_info_print_table_row(2, "Extension Version","$Id: php_zip.c,v 1.38
2007/01/29 16:01:55 pajoye Exp $");
+ php_info_print_table_row(2, "Extension Version","$Id: php_zip.c,v 1.39
2007/03/14 11:22:13 pajoye Exp $");
php_info_print_table_row(2, "Zip version", "2.0.0");
php_info_print_table_row(2, "Libzip version", "0.7.1");
http://cvs.php.net/viewvc.cgi/php-src/ext/zip/zip_stream.c?r1=1.5&r2=1.6&diff_format=u
Index: php-src/ext/zip/zip_stream.c
diff -u php-src/ext/zip/zip_stream.c:1.5 php-src/ext/zip/zip_stream.c:1.6
--- php-src/ext/zip/zip_stream.c:1.5 Mon Jan 1 09:29:34 2007
+++ php-src/ext/zip/zip_stream.c Wed Mar 14 11:22:13 2007
@@ -1,4 +1,4 @@
-/* $Id: zip_stream.c,v 1.5 2007/01/01 09:29:34 sebastian Exp $ */
+/* $Id: zip_stream.c,v 1.6 2007/03/14 11:22:13 pajoye Exp $ */
#ifdef HAVE_CONFIG_H
# include "config.h"
#endif
@@ -12,6 +12,7 @@
#include "ext/standard/file.h"
#include "ext/standard/php_string.h"
#include "fopen_wrappers.h"
+#include "php_zip.h"
#include "ext/standard/url.h"
@@ -112,6 +113,10 @@
}
if (filename) {
+ if (OPENBASEDIR_CHECKPATH(filename)) {
+ return NULL;
+ }
+
/* duplicate to make the stream za independent (esp. for
MSHUTDOWN) */
stream_za = zip_open(filename, ZIP_CREATE, &err);
if (!stream_za) {
@@ -189,6 +194,11 @@
php_basename(path, path_len - fragment_len, NULL, 0, &file_basename,
&file_basename_len TSRMLS_CC);
fragment++;
+ if (OPENBASEDIR_CHECKPATH(file_dirname)) {
+ efree(file_basename);
+ return NULL;
+ }
+
za = zip_open(file_dirname, ZIP_CREATE, &err);
if (za) {
zf = zip_fopen(za, fragment, 0);
--
PHP CVS Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
