|  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #16128 move_uploaded_file breaks safe_mode and open_basedir restrictions
Submitted: 2002-03-17 15:05 UTC Modified: 2005-01-31 23:00 UTC
Avg. Score:5.0 ± 0.0
Reproduced:1 of 2 (50.0%)
Same Version:1 (100.0%)
Same OS:1 (100.0%)
From: tozz at embrace dot selwerd dot nl Assigned:
Status: Closed Package: Safe Mode/open_basedir
PHP Version: 4.1.2 OS: Linux 2.4.13
Private report: No CVE-ID: None
 [2002-03-17 15:05 UTC] tozz at embrace dot selwerd dot nl
One of my customers has found a way to break my safe_mode and open_basedir restrictions. (

He created the following script:
$file = $HTTP_POST_FILES['file']['name'];
$type = $HTTP_POST_FILES['file']['type']; 
$size = $HTTP_POST_FILES['file']['size']; 
$temp = $HTTP_POST_FILES['file']['tmp_name'];

$size_limit = "100000"; // set size limit in bytes

if ($file){
if ($size < $size_limit){

move_uploaded_file($temp, "/domains/".$file);
echo "The file <tt>$file</tt> was sucessfully
} else {
echo "Sorry, your file exceeds the size limit of $size_limit

echo "
<form enctype='multipart/form-data' action=$PHP_SELF method=post>
Upload a file: <input name='file' type='file'>
<input type='submit' value='Upload'>

As you can see, he moved the uploaded file to:

Which should be impossible, because my httpd.conf says:

        DocumentRoot /domains/
        CustomLog /domains/ combined
        ErrorLog /domains/
        php_admin_value safe_mode 1
        php_admin_value open_basedir /domains/net

As you can see I have both set safe_mode and the open_basedir restriction but this user is able to upload any file where the apache user has write access.

Credits fly out to for finding this bug. 


Add a Patch

Pull Requests

Add a Pull Request


AllCommentsChangesGit/SVN commitsRelated reports
 [2002-03-17 15:21 UTC] tozz at embrace dot selwerd dot nl
The script in this example is a bit crippled due to wordwrapping. Here is the original script:
 [2002-03-17 16:03 UTC]
This bug has been fixed in CVS.

 [2002-03-18 14:18 UTC] wouter at widexs dot nl
In CVS it's fixed _if_ you use open_basedir. But if you don't, the php_checkuid fails to do it's work...
 [2002-03-18 14:20 UTC]
I advise you to test the CVS version before claiming this.

 [2002-03-18 17:24 UTC] tozz at embrace dot selwerd dot nl
I applied the patch from CVS (The CVS itself fucked up almost all my hosted sites), so I added :

if (php_check_open_basedir(Z_STRVAL_PP(new_path) TSRMLS_CC)) { RETURN_FALSE; } 

on row 2473 in ./ext/standard/basic_functions.c

I have disabled the open_basedir restriction for and I was able to upload to any directory that apache has write access too.

However, this could also be by design. Because without open_basedir PHP is not limited to a certain directory. And therefore PHP should indeed be able to write to any directory where PHP has write access. 

Or perhaps this is not wat wouter means :) If thats the case, sorry to bug you ;)
 [2002-03-18 19:21 UTC]
there was a typo in main/safe_mode.c, that was fixed some days ago. This typo is responsible for checkuid failing. You must apply this fix, too.
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Sun Apr 21 00:01:28 2024 UTC