php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #38183 disable_classes=Directory introduces new class "dir"?
Submitted: 2006-07-21 22:38 UTC Modified: 2006-07-22 15:41 UTC
Votes:2
Avg. Score:3.0 ± 0.0
Reproduced:2 of 2 (100.0%)
Same Version:1 (50.0%)
Same OS:0 (0.0%)
From: ch at hoffie dot info Assigned:
Status: Closed Package: PHP options/info functions
PHP Version: 5.1.4 OS: Linux 2.6
Private report: No CVE-ID:
 [2006-07-21 22:38 UTC] ch at hoffie dot info
Description:
------------
With disable_classes=Directory in the php.ini file, get_declared_classes() no longer returns the "Directory" class, but a class called "dir".

[This bug still exists in PHP 5.2, there you could also use "Date" (which results in "dat") or "Reflection..." (result: "ref") instead of Directory/dir (so Directory is not an exception, it's a general issue).]

Reproduce code:
---------------
christian@tux ~ $ echo "disable_classes=Directory" > /tmp/php.ini
christian@tux ~ $ php -c /tmp/php.ini -r 'var_dump(in_array("Directory", get_declared_classes()), in_array("dir", get_declared_classes())); new dir();'


Expected result:
----------------
bool(true)
bool(false)

Fatal error: Class 'dir' not found in Command line code on line 1


Actual result:
--------------
bool(false)
bool(true)

Warning: directory() has been disabled for security reasons in Command line code on line 1


Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2006-07-22 15:41 UTC] sniper@php.net
This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.


 
PHP Copyright © 2001-2014 The PHP Group
All rights reserved.
Last updated: Fri Apr 18 18:01:58 2014 UTC