|
|
php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login |
[2018-10-31 01:49 UTC] pavtov90 at gmail dot com
Description:
------------
I've seen previous reports, but their status is fixed.
Wrapper on Windows glob:// is not checked for open_basedir. If I checked correctly, where it is possible to insert it, errors will be generated that can be used as True or False. But I decided to test it simply, without unnecessary functions
Test script:
---------------
php.ini:
open_basedir = C:/php/
<?php
var_dump(glob("C:/test/1*"));
?>
Expected result:
----------------
Warning: _____ open_basedir restriction in effect...
Actual result:
--------------
If true (a file or folder exists)
Result : bool(false)
If false(no file or folder exists)
Result : array(0){}
PatchesPull RequestsHistoryAllCommentsChangesGit/SVN commits
|
|||||||||||||||||||||||||||||||||
Copyright © 2001-2025 The PHP GroupAll rights reserved. |
Last updated: Mon Oct 27 21:00:02 2025 UTC |
I am testing in Linux through ini_set('open_basedir','/path/'); And he gave me the same resultThe open_basedir check is done for each of the globbed files, and suppresses warnings[1], likely to prevent multiple warnings. However, it doesn't trigger a single open_basedir related warning, if an open_basedir violation had been detected[2]. > If false(no file or folder exists) > Result : array(0){} This is a particular issue. If no file is globbed, no individual open_basedir check can be done (and possibly fail). While there is a open_basedir check on the pattern[3], it is skipped on Windows, and I wonder whether it can be sufficient for all possible glob patterns on other systems. To avoid any open_basedir related differences, we could never return an empty array (and never raise an open_basedir warning), but that would be quite a BC break[4]. BTW: the `continue`[5] doesn't seem to make sense. A `break` should be more sensible. [1] <https://github.com/php/php-src/blob/php-7.3.0RC4/ext/standard/dir.c#L516> [2] <https://github.com/php/php-src/blob/php-7.3.0RC4/ext/standard/dir.c#L546-L547> [3] <https://github.com/php/php-src/blob/php-7.3.0RC4/ext/standard/dir.c#L504> [4] <https://github.com/php/php-src/blob/php-7.3.0RC4/ext/standard/dir.c#L478-L484> [5] <https://github.com/php/php-src/blob/php-7.3.0RC4/ext/standard/dir.c#L518>