Re: [PHP-DEV] open_basedir bypass - errata tempnam()

2011-09-28 Thread Antony Dovgal
On 09/28/2011 02:39 AM, Reindl Harald wrote: PLEASE REPLY ONLY TO THE LIST Please provide a short (10 lines max) but complete reproduce script. At the moment your explanations do not make any sense. -- Wbr, Antony Dovgal --- http://pinba.org - realtime profiling for PHP -- PHP Internals -

Re: [PHP-DEV] open_basedir bypass - errata tempnam()

2011-09-28 Thread Reindl Harald
Am 28.09.2011 08:01, schrieb Antony Dovgal: On 09/28/2011 02:39 AM, Reindl Harald wrote: PLEASE REPLY ONLY TO THE LIST Please provide a short (10 lines max) but complete reproduce script. At the moment your explanations do not make any sense. what do you think was the content of my last

Re: [PHP-DEV] open_basedir bypass - errata tempnam()

2011-09-28 Thread Pierre Joye
On Wed, Sep 28, 2011 at 9:02 AM, Reindl Harald h.rei...@thelounge.net wrote:  $tmp_name = str_replace(\\, '/', tempnam($temp_folder, 'rhcsv')); Side note: this is never necessary, php does it for you. Unless you store paths yourself before calling a php file function. -- Pierre @pierrejoye

Re: [PHP-DEV] open_basedir bypass - errata tempnam()

2011-09-28 Thread Reindl Harald
Am 28.09.2011 09:28, schrieb Pierre Joye: On Wed, Sep 28, 2011 at 9:02 AM, Reindl Harald h.rei...@thelounge.net wrote: $tmp_name = str_replace(\\, '/', tempnam($temp_folder, 'rhcsv')); Side note: this is never necessary, php does it for you. Unless you store paths yourself before

Re: [PHP-DEV] open_basedir bypass - errata tempnam()

2011-09-28 Thread Pierre Joye
hi, On Wed, Sep 28, 2011 at 9:02 AM, Reindl Harald h.rei...@thelounge.net wrote: First, all you need to test is: $tempfile = tempnam($temp_folder, 'rhcsv'); $fp = fopen($tempfile , 'w'); * /tmp MUST NOT be in open_basedir * the temp-folder must be read only * QUESTION1: why is tempnam()

Re: [PHP-DEV] open_basedir bypass - errata tempnam()

2011-09-28 Thread Reindl Harald
Am 28.09.2011 10:46, schrieb Pierre Joye: hi, On Wed, Sep 28, 2011 at 9:02 AM, Reindl Harald h.rei...@thelounge.net wrote: First, all you need to test is: $tempfile = tempnam($temp_folder, 'rhcsv'); $fp = fopen($tempfile , 'w'); * /tmp MUST NOT be in open_basedir * the temp-folder

Re: [PHP-DEV] open_basedir bypass - errata tempnam()

2011-09-28 Thread Pierre Joye
On Wed, Sep 28, 2011 at 10:50 AM, Reindl Harald h.rei...@thelounge.net wrote: but it is wrong to create a file outside the open_basedir especially if a full qualified directory was passed where it should be created Forgot to mention that this behavior is clearly documented:

Re: [PHP-DEV] open_basedir bypass - errata tempnam()

2011-09-28 Thread Reindl Harald
Am 28.09.2011 10:53, schrieb Pierre Joye: On Wed, Sep 28, 2011 at 10:50 AM, Reindl Harald h.rei...@thelounge.net wrote: without any param /tmp is right but not as magical fallback and in my opinion a well desigend webapp should never touch global /tmp shared with other hosts and

Re: [PHP-DEV] open_basedir bypass - errata tempnam()

2011-09-28 Thread Hannes Magnusson
On Wed, Sep 28, 2011 at 00:39, Reindl Harald h.rei...@thelounge.net wrote: PLEASE REPLY ONLY TO THE LIST PLEASE READ THE POSTING GUIDELINES BEFORE SCREAMING: http://se.php.net/mailing-lists.php Be sure to click Reply-All to reply to list. Clicking Reply will email the author of the message

Re: [PHP-DEV] open_basedir bypass - errata tempnam()

2011-09-28 Thread Reindl Harald
Am 28.09.2011 16:19, schrieb Hannes Magnusson: On Wed, Sep 28, 2011 at 00:39, Reindl Harald h.rei...@thelounge.net wrote: PLEASE REPLY ONLY TO THE LIST PLEASE READ THE POSTING GUIDELINES BEFORE SCREAMING: http://se.php.net/mailing-lists.php please configure the mailing-list correct please

[PHP-DEV] Mailing list handling (was: Re: [PHP-DEV] open_basedir bypass - errata tempnam())

2011-09-28 Thread Johannes Schlüter
On Wed, 2011-09-28 at 16:42 +0200, Reindl Harald wrote: Am 28.09.2011 16:19, schrieb Hannes Magnusson: On Wed, Sep 28, 2011 at 00:39, Reindl Harald h.rei...@thelounge.net wrote: PLEASE REPLY ONLY TO THE LIST PLEASE READ THE POSTING GUIDELINES BEFORE SCREAMING:

Re: [PHP-DEV] open_basedir bypass - errata tempnam()

2011-09-28 Thread Ferenc Kovacs
please configure the mailing-list correct please add a hint that modern clients have a reply-to-list for the record, I don't have that in gmail. please add a hint that the sender should be removed after reply-all because internals@lists.php.net is reaching the list AND the sender of the

Re: [PHP-DEV] open_basedir bypass - errata tempnam()

2011-09-28 Thread Rasmus Lerdorf
Reindl, please read http://www.unicom.com/pw/reply-to-harmful.html The list is configured correctly. On 09/28/2011 07:42 AM, Reindl Harald wrote: Am 28.09.2011 16:19, schrieb Hannes Magnusson: On Wed, Sep 28, 2011 at 00:39, Reindl Harald h.rei...@thelounge.net wrote: PLEASE REPLY ONLY TO

Re: [PHP-DEV] open_basedir bypass - errata tempnam()

2011-09-28 Thread Reindl Harald
Am 28.09.2011 17:03, schrieb Ferenc Kovacs: please configure the mailing-list correct please add a hint that modern clients have a reply-to-list for the record, I don't have that in gmail. please add a hint that the sender should be removed after reply-all because

Re: [PHP-DEV] open_basedir bypass - errata tempnam()

2011-09-28 Thread Nikita Popov
Hi Reindl! Do you realize that you are currently spamming hundreds of people that have subscribed this mailing list with pointless meta-discussions about how you think mailing list should work? The previous answer have already explained in detail why *all* mailing lists (this is not something

Re: [PHP-DEV] open_basedir bypass - errata tempnam()

2011-09-27 Thread Reindl Harald
Am 28.09.2011 00:16, schrieb Ángel González: Reindl Harald wrote: below a correct open_basedir restriction but why can fopen() create this file outside the basedir and after that the restriction is active? this means in other words: fopen() can empty files outside the basedir if their

Re: [PHP-DEV] open_basedir bypass - errata tempnam()

2011-09-27 Thread Ángel González
Reindl Harald schrieb: [root@arrakis:~]$ stat /tmp/rhcsvz8QeBL File: „/tmp/rhcsvz8QeBL“ Are you sure it is the fopen() what is making it? I think that some other function/extension may be creating the temporary file /tmp/rhcsvz8QeBL for you to open, which then fails due to the open_basedir.

Re: [PHP-DEV] open_basedir bypass - errata tempnam()

2011-09-27 Thread Reindl Harald
Am 28.09.2011 00:34, schrieb Ángel González: Reindl Harald schrieb: [root@arrakis:~]$ stat /tmp/rhcsvz8QeBL File: „/tmp/rhcsvz8QeBL“ Are you sure it is the fopen() what is making it? I think that some other function/extension may be creating the temporary file /tmp/rhcsvz8QeBL for