php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #12255 (In safe mode) The UID check in chdir don't test the good directory
Submitted: 2001-07-19 10:55 UTC Modified: 2001-07-26 21:38 UTC
From: benoit at proxad dot net Assigned:
Status: Closed Package: Directory function related
PHP Version: 4.0.6 OS: Debian GNU/Linux sid
Private report: No CVE-ID: None
View Developer Edit
 [2001-07-19 10:55 UTC] benoit at proxad dot net 
In safe mode, when you chdir a specific directory, it does not test the UID of directory but the UID of the directory below.

Let's say we do a chdir ("/home/benoit");
In safe mode, it will test the UID of /home against the one of the script so it fails.

If we do a chdir ("/home/benoit/."); , PHP test the UID of /home/benoit/ against the UID of the script and succeed.

But, logically, the two commands should succeed the same way.

I think it's related to the code in "ext/standard/dir.c" around line 286 :
> if (PG(safe_mode) && !php_checkuid((*arg)->value.str.val, NULL, CHECKUID_ALLOW_ONLY_DIR)) {
and the way php_checkuid handle CHECKUID_ALLOW_ONLY_DIR.

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2001-07-19 16:20 UTC] jflemer@php.net 
I fixed this in CVS. This is a duplicate bug report.
 [2001-07-26 21:38 UTC] sniper@php.net 
fixed -> closed.
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved. 		Last updated: Tue Nov 04 10:00:02 2025 UTC