|
php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login |
PatchesPull RequestsHistoryAllCommentsChangesGit/SVN commits
[2006-02-05 21:40 UTC] tony2001@php.net
[2006-02-05 21:41 UTC] the dot spikey at gmail dot com
|
|||||||||||||||||||||||||||
Copyright © 2001-2025 The PHP GroupAll rights reserved. |
Last updated: Thu Oct 30 14:00:01 2025 UTC |
Description: ------------ The COPY function can write/read files where you have no permission to. (Maybe in combination with the tempnam function, maybe without). Reproduce code: --------------- $tempfn = tempnam("",""); $temp = fopen($tempfn, "w"); fwrite ($temp, $newtxt); copy ($tempfn, "mysql.php"); Expected result: ---------------- Line 1: $tempfn = the created temporary filename. Line 2: Open the temp. file with write access. Line 3: write your text $newtxt in $temp. Line 4: Copy your newly created temporary file over mysql.php, even without write access. Actual result: -------------- (same as above) Line 1: $tempfn = the created temporary filename. Line 2: Open the temp. file with write access. Line 3: write your text $newtxt in $temp. Line 4: Copy your newly created temporary file over mysql.php, even without write access.