Re: [PHP-DEV] open_basedir bypass - errata tempnam()

2011-09-28 Thread Antony Dovgal
On 09/28/2011 02:39 AM, Reindl Harald wrote: PLEASE REPLY ONLY TO THE LIST Please provide a short (10 lines max) but complete reproduce script. At the moment your explanations do not make any sense. -- Wbr, Antony Dovgal --- http://pinba.org - realtime profiling for PHP -- PHP Internals -

Re: [PHP-DEV] open_basedir bypass - errata tempnam()

2011-09-28 Thread Reindl Harald
Am 28.09.2011 08:01, schrieb Antony Dovgal: On 09/28/2011 02:39 AM, Reindl Harald wrote: PLEASE REPLY ONLY TO THE LIST Please provide a short (10 lines max) but complete reproduce script. At the moment your explanations do not make any sense. what do you think was the content of my last

Re: [PHP-DEV] open_basedir bypass - errata tempnam()

2011-09-28 Thread Pierre Joye
On Wed, Sep 28, 2011 at 9:02 AM, Reindl Harald h.rei...@thelounge.net wrote:  $tmp_name = str_replace(\\, '/', tempnam($temp_folder, 'rhcsv')); Side note: this is never necessary, php does it for you. Unless you store paths yourself before calling a php file function. -- Pierre @pierrejoye

Re: [PHP-DEV] open_basedir bypass - errata tempnam()

2011-09-28 Thread Reindl Harald
Am 28.09.2011 09:28, schrieb Pierre Joye: On Wed, Sep 28, 2011 at 9:02 AM, Reindl Harald h.rei...@thelounge.net wrote: $tmp_name = str_replace(\\, '/', tempnam($temp_folder, 'rhcsv')); Side note: this is never necessary, php does it for you. Unless you store paths yourself before

Re: [PHP-DEV] open_basedir bypass - errata tempnam()

2011-09-28 Thread Pierre Joye
hi, On Wed, Sep 28, 2011 at 9:02 AM, Reindl Harald h.rei...@thelounge.net wrote: First, all you need to test is: $tempfile = tempnam($temp_folder, 'rhcsv'); $fp = fopen($tempfile , 'w'); * /tmp MUST NOT be in open_basedir * the temp-folder must be read only * QUESTION1: why is tempnam()

Re: [PHP-DEV] open_basedir bypass - errata tempnam()

2011-09-28 Thread Reindl Harald
Am 28.09.2011 10:46, schrieb Pierre Joye: hi, On Wed, Sep 28, 2011 at 9:02 AM, Reindl Harald h.rei...@thelounge.net wrote: First, all you need to test is: $tempfile = tempnam($temp_folder, 'rhcsv'); $fp = fopen($tempfile , 'w'); * /tmp MUST NOT be in open_basedir * the temp-folder

Re: [PHP-DEV] open_basedir bypass - errata tempnam()

2011-09-28 Thread Pierre Joye
On Wed, Sep 28, 2011 at 10:50 AM, Reindl Harald h.rei...@thelounge.net wrote: but it is wrong to create a file outside the open_basedir especially if a full qualified directory was passed where it should be created Forgot to mention that this behavior is clearly documented:

Re: [PHP-DEV] open_basedir bypass - errata tempnam()

2011-09-28 Thread Reindl Harald
Am 28.09.2011 10:53, schrieb Pierre Joye: On Wed, Sep 28, 2011 at 10:50 AM, Reindl Harald h.rei...@thelounge.net wrote: without any param /tmp is right but not as magical fallback and in my opinion a well desigend webapp should never touch global /tmp shared with other hosts and

Re: [PHP-DEV] open_basedir bypass - errata tempnam()

2011-09-28 Thread Hannes Magnusson
On Wed, Sep 28, 2011 at 00:39, Reindl Harald h.rei...@thelounge.net wrote: PLEASE REPLY ONLY TO THE LIST PLEASE READ THE POSTING GUIDELINES BEFORE SCREAMING: http://se.php.net/mailing-lists.php Be sure to click Reply-All to reply to list. Clicking Reply will email the author of the message

Re: [PHP-DEV] open_basedir bypass - errata tempnam()

2011-09-28 Thread Reindl Harald
Am 28.09.2011 16:19, schrieb Hannes Magnusson: On Wed, Sep 28, 2011 at 00:39, Reindl Harald h.rei...@thelounge.net wrote: PLEASE REPLY ONLY TO THE LIST PLEASE READ THE POSTING GUIDELINES BEFORE SCREAMING: http://se.php.net/mailing-lists.php please configure the mailing-list correct please

[PHP-DEV] Mailing list handling (was: Re: [PHP-DEV] open_basedir bypass - errata tempnam())

2011-09-28 Thread Johannes Schlüter
On Wed, 2011-09-28 at 16:42 +0200, Reindl Harald wrote: Am 28.09.2011 16:19, schrieb Hannes Magnusson: On Wed, Sep 28, 2011 at 00:39, Reindl Harald h.rei...@thelounge.net wrote: PLEASE REPLY ONLY TO THE LIST PLEASE READ THE POSTING GUIDELINES BEFORE SCREAMING:

Re: [PHP-DEV] open_basedir bypass - errata tempnam()

2011-09-28 Thread Ferenc Kovacs
please configure the mailing-list correct please add a hint that modern clients have a reply-to-list for the record, I don't have that in gmail. please add a hint that the sender should be removed after reply-all because internals@lists.php.net is reaching the list AND the sender of the

Re: [PHP-DEV] open_basedir bypass - errata tempnam()

2011-09-28 Thread Rasmus Lerdorf
Reindl, please read http://www.unicom.com/pw/reply-to-harmful.html The list is configured correctly. On 09/28/2011 07:42 AM, Reindl Harald wrote: Am 28.09.2011 16:19, schrieb Hannes Magnusson: On Wed, Sep 28, 2011 at 00:39, Reindl Harald h.rei...@thelounge.net wrote: PLEASE REPLY ONLY TO

Re: [PHP-DEV] open_basedir bypass - errata tempnam()

2011-09-28 Thread Reindl Harald
Am 28.09.2011 17:03, schrieb Ferenc Kovacs: please configure the mailing-list correct please add a hint that modern clients have a reply-to-list for the record, I don't have that in gmail. please add a hint that the sender should be removed after reply-all because

Re: [PHP-DEV] open_basedir bypass - errata tempnam()

2011-09-28 Thread Nikita Popov
Hi Reindl! Do you realize that you are currently spamming hundreds of people that have subscribed this mailing list with pointless meta-discussions about how you think mailing list should work? The previous answer have already explained in detail why *all* mailing lists (this is not something

Re: [PHP-DEV] Reply-to of mailing lists (was: open_basedir bypass - errata tempnam() )

2011-09-28 Thread Ángel González
Ferenc Kovacs wrote: well if there would be used Reply-To-Headers tell me ONE reason to get every answer twice I don't get two emails in gmail, I don't know that the list is smart enough to not send emails those who are to or cc'ed, or maybe it's a gmail feature. That's a gmail (mis)feature.

Re: [PHP-DEV] Reply-to of mailing lists (was: open_basedir bypass - errata tempnam() )

2011-09-28 Thread Ferenc Kovacs
2011/9/28 Ángel González keis...@gmail.com: Ferenc Kovacs wrote: well if there would be used Reply-To-Headers tell me ONE reason to get every answer twice I don't get two emails in gmail, I don't know that the list is smart enough to not send emails those who are to or cc'ed, or maybe it's

Re: [PHP-DEV] Reply-to of mailing lists

2011-09-28 Thread Stas Malyshev
Hi! That's a gmail (mis)feature. If you receive an email twice, it is collapsed into one. I actually don't get emails twice when replied to personally and on the list too... Not gmail, exchange+Thunderbird, no idea who of them does it but I'm OK with it. -- Stanislav Malyshev, Software

Re: [PHP-DEV] Reply-to of mailing lists

2011-09-28 Thread Ángel González
Ferenc Kovacs wrote: A benefit of being addressed in the email that hasn't been mentioned yet, johannes mentioned it: http://www.mail-archive.com/internals@lists.php.net/msg53737.html Yes, I noticed it /after/ sending. :( Our emails were alike. We mentioned the same usage pattern and both