|
php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login |
PatchesPull RequestsHistoryAllCommentsChangesGit/SVN commits
[2018-09-17 15:14 UTC] cmb@php.net
-Type: Security
+Type: Bug
[2018-09-17 15:14 UTC] cmb@php.net
[2018-09-17 17:02 UTC] fernando at null-life dot com
[2021-08-18 15:33 UTC] cmb@php.net
[2025-01-27 12:59 UTC] cmb@php.net
-Status: Open
+Status: Closed
-Assigned To:
+Assigned To: cmb
[2025-01-27 12:59 UTC] cmb@php.net
|
|||||||||||||||||||||||||||||||||
Copyright © 2001-2025 The PHP GroupAll rights reserved. |
Last updated: Fri Oct 24 17:00:01 2025 UTC |
Description: ------------ When specifying a file that is outside of the openbasedir path, imageftbbox emits two warnings when the file used as a font exists, and only one when it doesn't. This allows to identify existing paths/files. I'm testing on Windows only. For example: imageftbbox(10, 0, "C:\\windows", 'PHP'); Warning: imageftbbox(): open_basedir restriction in effect. File(c:\windows) is not within the allowed path(s): (C:\tools\phuzzer) in C:\tools\phuzzer\imageft.php on line 15 Warning: imageftbbox(): Invalid font filename in C:\tools\phuzzer\imageft.php on line 15 Test script: --------------- php.exe -n -dopen_basedir=C:\tools\phuzzer -dextension=ext\php_gd2.dll imageft.php <?php function myErrorHandler($errno, $errstr, $errfile, $errline) { global $errorsgenerated; $errorsgenerated = $errorsgenerated + 1; return true; } set_error_handler('myErrorHandler'); function file_exists_openbasedir($path) { global $errorsgenerated; $errorsgenerated = 0; imageftbbox(10, 0, $path, 'PHP'); return $errorsgenerated > 1; } echo "c:\\anythingelse ".(file_exists_openbasedir("c:\\anythingelse") ? "exists" : "doesnt exist").PHP_EOL; echo "c:\\windows ".(file_exists_openbasedir("c:\\windows")? "exists" : "doesnt exist").PHP_EOL; Expected result: ---------------- Same behavior regardless the file exists or no. Actual result: -------------- c:\anythingelse doesnt exist c:\windows exists