iliaa Tue Jun 12 12:57:43 2007 UTC Modified files: /php-src/ext/standard dir.c Log: MFB: Fixed bug #41655 (open_basedir bypass via glob()) http://cvs.php.net/viewvc.cgi/php-src/ext/standard/dir.c?r1=1.161&r2=1.162&diff_format=u Index: php-src/ext/standard/dir.c diff -u php-src/ext/standard/dir.c:1.161 php-src/ext/standard/dir.c:1.162 --- php-src/ext/standard/dir.c:1.161 Tue May 29 20:11:23 2007 +++ php-src/ext/standard/dir.c Tue Jun 12 12:57:43 2007 @@ -16,7 +16,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: dir.c,v 1.161 2007/05/29 20:11:23 iliaa Exp $ */ +/* $Id: dir.c,v 1.162 2007/06/12 12:57:43 iliaa Exp $ */ /* {{{ includes/startup/misc */ @@ -385,7 +385,6 @@ Find pathnames matching a pattern */ PHP_FUNCTION(glob) { - char cwd[MAXPATHLEN]; int cwd_skip = 0; #ifdef ZTS char work_pattern[MAXPATHLEN]; @@ -422,6 +421,19 @@ } #endif + if (PG(open_basedir) && *PG(open_basedir)) { + size_t base_len = php_dirname(pattern, strlen(pattern)); + char pos = pattern[base_len]; + + pattern[base_len] = '\0'; + + if (php_check_open_basedir(pattern TSRMLS_CC)) { + RETURN_FALSE; + } + + pattern[base_len] = pos; + } + globbuf.gl_offs = 0; if (0 != (ret = glob(pattern, flags & GLOB_FLAGMASK, NULL, &globbuf))) { #ifdef GLOB_NOMATCH @@ -447,14 +459,6 @@ return; } - /* we assume that any glob pattern will match files from one directory only - so checking the dirname of the first match should be sufficient */ - strlcpy(cwd, globbuf.gl_pathv[0], MAXPATHLEN); - - if (php_check_open_basedir(cwd TSRMLS_CC)) { - RETURN_FALSE; - } - array_init(return_value); for (n = 0; n < globbuf.gl_pathc; n++) { /* we need to do this everytime since GLOB_ONLYDIR does not guarantee that
-- PHP CVS Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php