php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #12255 (In safe mode) The UID check in chdir don't test the good directory
Submitted: 2001-07-19 10:55 UTC Modified: 2001-07-26 21:38 UTC
From: benoit at proxad dot net Assigned:
Status: Closed Package: Directory function related
PHP Version: 4.0.6 OS: Debian GNU/Linux sid
Private report: No CVE-ID: None
View Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
If you reported this bug, you can edit this bug over here.
(description)
Block user comment
Status: Assign to:
Package:
Bug Type:
Summary:
From: benoit at proxad dot net
New email:
PHP Version: OS:

 

 [2001-07-19 10:55 UTC] benoit at proxad dot net 
In safe mode, when you chdir a specific directory, it does not test the UID of directory but the UID of the directory below.

Let's say we do a chdir ("/home/benoit");
In safe mode, it will test the UID of /home against the one of the script so it fails.

If we do a chdir ("/home/benoit/."); , PHP test the UID of /home/benoit/ against the UID of the script and succeed.

But, logically, the two commands should succeed the same way.

I think it's related to the code in "ext/standard/dir.c" around line 286 :
> if (PG(safe_mode) && !php_checkuid((*arg)->value.str.val, NULL, CHECKUID_ALLOW_ONLY_DIR)) {
and the way php_checkuid handle CHECKUID_ALLOW_ONLY_DIR.

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2001-07-19 16:20 UTC] jflemer@php.net 
I fixed this in CVS. This is a duplicate bug report.
 [2001-07-26 21:38 UTC] sniper@php.net 
fixed -> closed.
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved. 		Last updated: Wed Jan 15 04:01:28 2025 UTC