stas Tue Jul 10 17:40:41 2007 UTC
Modified files: (Branch: PHP_5_2)
/php-src/ext/session mod_files.c
Log:
always check save_path (issue reported by Maksymilian Arciemowicz)
http://cvs.php.net/viewvc.cgi/php-src/ext/session/mod_files.c?r1=1.100.2.3.2.5&r2=1.100.2.3.2.6&diff_format=u
Index: php-src/ext/session/mod_files.c
diff -u php-src/ext/session/mod_files.c:1.100.2.3.2.5
php-src/ext/session/mod_files.c:1.100.2.3.2.6
--- php-src/ext/session/mod_files.c:1.100.2.3.2.5 Sat Mar 3 15:07:31 2007
+++ php-src/ext/session/mod_files.c Tue Jul 10 17:40:41 2007
@@ -16,7 +16,7 @@
+----------------------------------------------------------------------+
*/
-/* $Id: mod_files.c,v 1.100.2.3.2.5 2007/03/03 15:07:31 iliaa Exp $ */
+/* $Id: mod_files.c,v 1.100.2.3.2.6 2007/07/10 17:40:41 stas Exp $ */
#include "php.h"
@@ -294,6 +294,14 @@
}
save_path = argv[argc - 1];
+ if (PG(safe_mode) && (!php_checkuid(save_path, NULL,
CHECKUID_CHECK_FILE_AND_DIR))) {
+ return FAILURE;
+ }
+
+ if (PG(open_basedir) && php_check_open_basedir(save_path TSRMLS_CC)) {
+ return FAILURE;
+ }
+
data = emalloc(sizeof(*data));
memset(data, 0, sizeof(*data));
@@ -304,7 +312,7 @@
data->basedir = estrndup(save_path, data->basedir_len);
PS_SET_MOD_DATA(data);
-
+
return SUCCESS;
}
--
PHP CVS Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
