php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #19650 4.2.3 (!) "include" operator mistake
Submitted: 2002-09-28 11:23 UTC Modified: 2002-10-28 05:14 UTC
Votes:4
Avg. Score:4.8 ± 0.4
Reproduced:4 of 4 (100.0%)
Same Version:4 (100.0%)
Same OS:4 (100.0%)
From: dmitry at koteroff dot ru Assigned:
Status: Closed Package: Scripting Engine problem
PHP Version: 4.2.3 OS: Windows
Private report: No CVE-ID: None
View Add Comment Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
You can add a comment by following this link or if you reported this bug, you can edit this bug over here.
(description)
Block user comment
Status: Assign to:
Package:
Bug Type:
Summary:
From: dmitry at koteroff dot ru
New email:
PHP Version: OS:

 

 [2002-09-28 11:23 UTC] dmitry at koteroff dot ru
I'm trying to write here again (maybe previous thread is down?). You said before this bug in NOT actual in 4.2.3, but code STILL DOES NOT work in 4.2.3.

So, PHP v4.2.0 (and later) on Windows:
include "/home/some/site.php";
- DOES NOT work (try to believe)! We have to use instead:
include "z:/home/some/site.php"; # bad... Bad?.. BAD!!!

Previous PHP v4.1.0:
include "/home/some/site.php";
- works correct.

I think that since 4.2.0 pathes like "/some/where" does not treated as absolute. For example, if we add "z:" to "include_path", include "/home/some/site.php" become workable - it is only the prove.

It is VERY loathsome bug, because it makes Windows scripts incompatible with Unix and with previous PHP versions.

Again, new version (4.2.3) has THE SAME bug:

Z:\!distrib\php-4.2.3-Win32>php.exe
<?
include "/test.php";
?>
^Z

Warning: Failed opening '/test.php' for inclusion
(include_path='.;c:\php4\pear') in - on line 2

If I use "include 'z:/test.php'", it works. 
Please help (our clients are very angry!)

P.S.
DocumentRoot "/home/site/www"
...
GET http://site/test.php - DOES NOT work too. It seems to me mod_php
uses the same "include" function while starting the script.

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2002-09-28 23:01 UTC] sniper@php.net
Please try using this CVS snapshot:

  http://snaps.php.net/php4-latest.tar.gz
 
For Windows:
 
  http://snaps.php.net/win32/php4-win32-latest.zip
 [2002-09-30 06:28 UTC] dmitry at koteroff dot ru
Version
http://snaps.php.net/win32/php4-win32-latest.zip

STILL DOES NOT WORK (z:/test.php contains "echo '!'"):

Z:\!distrib\aaa>php.exe
<?
include "z:/test.php";
?>
^Z
!

Z:\!distrib\aaa>php.exe
<?
include "/test.php";
?>
^Z

Warning: main(/test.php) [http://www.php.net/function.main]: failed to create stream:
No such file or directory in Z:\!distrib\aaa\- on line 2

Warning: Failed opening '/test.php' for inclusion (include_path='.;c:\php4\pear') in Z:\!dis
trib\aaa\- on line 2
 [2002-10-01 10:33 UTC] sniper@php.net
Please do not submit the same bug more than once. An existing
bug report already describes this very problem. Even if you feel
that your issue is somewhat different, the resolution is likely
to be the same. Because of this, we hope you add your comments
to the original bug instead.

Thank you for your interest in PHP.


The other report of yours, #19689, has more information
so closing this..

 [2002-10-01 10:42 UTC] jmoore@php.net
Dup not bogus
 [2002-10-01 10:49 UTC] sniper@php.net
A) same problem b) same submitter -> bogus
 [2002-10-05 15:35 UTC] dmitry at koteroff dot ru
New information about this bug.

1. Since version PHP 4.2.3 bug is "changed":

File /t.php AND ./t.php (identical):
<?include "/test.php"?>

Tests:
a) > php.exe c:\t.php - works
b) > php.exe \t.php - works
c) > php.exe /t.php - works
d) > php.exe
     <?include "/test.php"?>
     ^Z
     - DOES NOT work.

In version 4.1.2...4.2.2 a, b & c are not working.

2. Versions <= 4.1.1 work correctly.

So, I think there is only an error if PHP.exe v4.2.3+ gets program from STDIN. Previous versions (<4.2.3) do not work with command-line filename too.
 [2002-10-05 16:07 UTC] neuman_peter at hotmail dot com
<?include "/test.php"?> is not good

this is better:
<?php
include ("./test.php");
?>

ok?
 [2002-10-05 18:49 UTC] dmitry at koteroff dot ru
Of course, not OK (-;

File c:\t.php:
<?php include "/test.php" ?>

File c:\test.php:
<?php echo "!" ?>

c:\php> php.exe -q < c:\t.php
<br />
<b>Warning</b>:  Failed opening '/test.php' for inclusion
(include_path='.;c:\php4\pear') in <b>-</b> on line <b>2</b><br />

c:\php> php.exe -q c:\t.php
!

Strange, isn't it?..

Good "/test.php", or not good, when I write 
  DocumentRoot /home/localhost/www
in httpd.conf, and then 
  GET /phpinfo.php HTTP/1.1
Apache calls /home/localhost/www/phpinfo.php, but not ./home/localhost/www (-; Well, 4.2.3 processes it correctly (and we may close this bug report), but...

I meant that PHP 4.2.3 still have something wrong in its code, because absolute-slashed pathes do not work sometimes (like in "< script", maybe somewhere else?). Here, in Russia, we saying in such cases: "Heh, something's wrong in Danish kingdom". (-; Today I tried to debug it, but have not found a bug place. Maybe next time.

Good luck.
 [2002-10-07 12:18 UTC] dmitry at koteroff dot ru
Wow... I'm a fool, I have tested wrong PHP version! Error is still actual.

But now I think I have found the bug place.

File main/fopen_wrappers.c, in function php_fopen_with_path, we can see a piece of code:

if (IS_ABSOLUTE_PATH(filename, filename_length)) {
  if ((php_check_safe_mode_include_dir(filename TSRMLS_CC)) == 0)
  /* filename is in safe_mode_include_dir (or subdir) */
  return php_fopen_and_set_opened_path(filename, mode, opened_path TSRMLS_CC);
  if (PG(safe_mode) && (!php_checkuid(filename, mode, CHECKUID_CHECK_MODE_PARAM)))
  return NULL;
  return php_fopen_and_set_opened_path(filename, mode, opened_path TSRMLS_CC);
}
/* else start to glue path from include_path */
...

Under Windows IS_ABSOLUTE_PATH is:
#define IS_ABSOLUTE_PATH(path, len) \
	(len >= 2 && isalpha(path[0]) && path[1] == ':')

Of course, when Apache's mod_php4 makes "include" request for "/home/localhost/www/phpinfo.php", program DOES NOT get into "if" statement! And we get pathes something like 
".//home/localhost/www/phpinfo.php" and "c:/php/pear//home/localhost/www/phpinfo.php" when include_path=".;c:/php/pear" (I have dumped "path" argument of virtual_fopen function [tsrm_virtual-cwd.c] to watch such pathes).

We cannot modify IS_ABSOLUTE_PATH macro, because there is #define COPY_WHEN_ABSOLUTE 2 before it, and core always think that "absolute" part contains 2 characters - we'd like to thank developers of windows port for that :-(. Path "/some/path" contains NONE "absolute" characters ("z:/some/path" contains two - "z:").

But, if we patch:

- if (IS_ABSOLUTE_PATH(filename, filename_length)) {
+ if (IS_ABSOLUTE_PATH(filename, filename_length) 
+     || IS_SLASH(*filename)) {

PHP begins to work!

I don't know would it cause a security problem with safe_mode. Code is too tangled and duplicated (somebody likes "copy+paste" technique of programming, I suppose).

Please correct this bug in next PHPs. Now I will patch it "by hands", but I don't want our users to cry when they would install newer version and it begin to trash.
 [2002-10-12 10:26 UTC] sniper@php.net
Please try using this CVS snapshot:

  http://snaps.php.net/php4-latest.tar.gz
 
For Windows:
 
  http://snaps.php.net/win32/php4-win32-latest.zip


 [2002-10-27 19:11 UTC] sniper@php.net
No feedback was provided. The bug is being suspended because
we assume that you are no longer experiencing the problem.
If this is not the case and you are able to provide the
information that was requested earlier, please do so and
change the status of the bug back to "Open". Thank you.


 [2002-10-28 05:14 UTC] dmitry at koteroff dot ru
OK, today's snapshot (27 0ct 2002) seems to be correct:

z:/t.php:
<?include "/test.php"?>

z:/test.php:
<?echo "!"?>

Z:\!distrib\php\php4-win32-latest>php.exe /t.php
!

Thanks. But I suppose that this bug is deeply rooted. When I make PHP to read a script from STDIN:

Z:\!distrib\php\php4-win32-latest>php.exe
<?include "/test.php"?>
^Z

Warning: main(/test.php) [http://www.php.net/function.main]: failed to create stream: No such file or directory in Z:\!distrib\php\php4-win32-latest\- on line 2

Warning: Failed opening '/test.php' for inclusion (include_path='.;c:\php4\pear') in Z:\!dis
trib\php\php4-win32-latest\- on line 2

Of course,

Z:\!distrib\php\php4-win32-latest>php.exe
<?include "z:/test.php"?>
^Z
!
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Thu May 02 04:01:30 2024 UTC