|
php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login |
[2002-09-28 11:23 UTC] dmitry at koteroff dot ru
I'm trying to write here again (maybe previous thread is down?). You said before this bug in NOT actual in 4.2.3, but code STILL DOES NOT work in 4.2.3. So, PHP v4.2.0 (and later) on Windows: include "/home/some/site.php"; - DOES NOT work (try to believe)! We have to use instead: include "z:/home/some/site.php"; # bad... Bad?.. BAD!!! Previous PHP v4.1.0: include "/home/some/site.php"; - works correct. I think that since 4.2.0 pathes like "/some/where" does not treated as absolute. For example, if we add "z:" to "include_path", include "/home/some/site.php" become workable - it is only the prove. It is VERY loathsome bug, because it makes Windows scripts incompatible with Unix and with previous PHP versions. Again, new version (4.2.3) has THE SAME bug: Z:\!distrib\php-4.2.3-Win32>php.exe <? include "/test.php"; ?> ^Z Warning: Failed opening '/test.php' for inclusion (include_path='.;c:\php4\pear') in - on line 2 If I use "include 'z:/test.php'", it works. Please help (our clients are very angry!) P.S. DocumentRoot "/home/site/www" ... GET http://site/test.php - DOES NOT work too. It seems to me mod_php uses the same "include" function while starting the script. PatchesPull RequestsHistoryAllCommentsChangesGit/SVN commits
|
|||||||||||||||||||||||||||||||||||||
Copyright © 2001-2025 The PHP GroupAll rights reserved. |
Last updated: Sun Nov 30 06:00:01 2025 UTC |
New information about this bug. 1. Since version PHP 4.2.3 bug is "changed": File /t.php AND ./t.php (identical): <?include "/test.php"?> Tests: a) > php.exe c:\t.php - works b) > php.exe \t.php - works c) > php.exe /t.php - works d) > php.exe <?include "/test.php"?> ^Z - DOES NOT work. In version 4.1.2...4.2.2 a, b & c are not working. 2. Versions <= 4.1.1 work correctly. So, I think there is only an error if PHP.exe v4.2.3+ gets program from STDIN. Previous versions (<4.2.3) do not work with command-line filename too.<?include "/test.php"?> is not good this is better: <?php include ("./test.php"); ?> ok?Wow... I'm a fool, I have tested wrong PHP version! Error is still actual. But now I think I have found the bug place. File main/fopen_wrappers.c, in function php_fopen_with_path, we can see a piece of code: if (IS_ABSOLUTE_PATH(filename, filename_length)) { if ((php_check_safe_mode_include_dir(filename TSRMLS_CC)) == 0) /* filename is in safe_mode_include_dir (or subdir) */ return php_fopen_and_set_opened_path(filename, mode, opened_path TSRMLS_CC); if (PG(safe_mode) && (!php_checkuid(filename, mode, CHECKUID_CHECK_MODE_PARAM))) return NULL; return php_fopen_and_set_opened_path(filename, mode, opened_path TSRMLS_CC); } /* else start to glue path from include_path */ ... Under Windows IS_ABSOLUTE_PATH is: #define IS_ABSOLUTE_PATH(path, len) \ (len >= 2 && isalpha(path[0]) && path[1] == ':') Of course, when Apache's mod_php4 makes "include" request for "/home/localhost/www/phpinfo.php", program DOES NOT get into "if" statement! And we get pathes something like ".//home/localhost/www/phpinfo.php" and "c:/php/pear//home/localhost/www/phpinfo.php" when include_path=".;c:/php/pear" (I have dumped "path" argument of virtual_fopen function [tsrm_virtual-cwd.c] to watch such pathes). We cannot modify IS_ABSOLUTE_PATH macro, because there is #define COPY_WHEN_ABSOLUTE 2 before it, and core always think that "absolute" part contains 2 characters - we'd like to thank developers of windows port for that :-(. Path "/some/path" contains NONE "absolute" characters ("z:/some/path" contains two - "z:"). But, if we patch: - if (IS_ABSOLUTE_PATH(filename, filename_length)) { + if (IS_ABSOLUTE_PATH(filename, filename_length) + || IS_SLASH(*filename)) { PHP begins to work! I don't know would it cause a security problem with safe_mode. Code is too tangled and duplicated (somebody likes "copy+paste" technique of programming, I suppose). Please correct this bug in next PHPs. Now I will patch it "by hands", but I don't want our users to cry when they would install newer version and it begin to trash.