php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #24333 stat() and file_exists() is neither affected by safe_mode nor open_basedir
Submitted: 2003-06-25 07:31 UTC Modified: 2005-01-31 23:21 UTC
From: david at darville dot name Assigned:
Status: Closed Package: Safe Mode/open_basedir
PHP Version: 4.3.2 OS: RedHat Linux
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: david at darville dot name
New email:
PHP Version: OS:

 

 [2003-06-25 07:31 UTC] david at darville dot name
Description:
------------
Even when safe mode is enabled, and open_basedir restrictions is in place, it is possible to use file_exists(), stat() (and fileperms()) on any file on the system.


Reproduce code:
---------------
$filename = "/etc/shadow";
if (file_exists($filename))
{
  echo "$filename exists\n";
}
else
{
  echo "$filename does not exist\n";
}

$stat = stat($filename);



Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2003-06-25 10:32 UTC] sniper@php.net
Already fixed in CVS.

 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved.
Last updated: Sun Jan 05 03:01:28 2025 UTC