|
|
php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login |
[2006-08-31 12:29 UTC] serokka at hrn dot ru
Description:
------------
I got a problem with open_basedir between Apache's (2.0.55) virtual hosts.
This error appeared in 4.4.x branch!
PHP 4.3.11 does NOT have this error.
----------------------------------------
Warning: Unknown(): open_basedir restriction in effect. File(/pub/home/xxxxxxx/tmp) is not within the allowed path(s): (/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/php/lib/php:/usr/local/mysql/bin:/pub/home/yyyyyyyy) in Unknown on line 0
----------------------------------------
This is very serious bug and it stops us from using PHP 4.4.x
Reproduce code:
---------------
<VirtualHost aaa.aaa.aaa.aaa:80>
..............
php_admin_value doc_root '/pub/home/xxxxxxx'
php_admin_value upload_tmp_dir '/pub/home/xxxxxxx/tmp'
php_admin_value session.save_path '/pub/home/xxxxxxx/tmp'
php_admin_value open_basedir '/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/php/lib/php:/usr/local/
mysql/bin:/pub/home/xxxxxxx'
..............
</VirtualHost>
<VirtualHost aaa.aaa.aaa.aaa:80>
..............
php_admin_value doc_root '/pub/home/yyyyyyyy'
php_admin_value upload_tmp_dir '/pub/home/yyyyyyyy/tmp'
php_admin_value session.save_path '/pub/home/yyyyyyyy/tmp'
php_admin_value open_basedir '/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/php/lib/php:/usr/local/
mysql/bin:/pub/home/yyyyyyyy'
..............
</VirtualHost>
PatchesPull RequestsHistoryAllCommentsChangesGit/SVN commits
|
|||||||||||||||||||||||||||||||||||||
Copyright © 2001-2024 The PHP GroupAll rights reserved. |
Last updated: Mon Dec 30 14:01:28 2024 UTC |
I have checked the diffs of session.c implementations between 4.3.11 and php4-latest-snapshot, here is the same that brought my attention. As i understand correctly, there is implementation of checking boundaries such as open_basedir at runtime if it was got from Apache VirtualHost section. So, the problem was from the beginning of 4 branch??? Is there a security leak, cause sessions sometimes got their paths from other VirtualHost??? ------------------------------------------------------------ @@ -117,6 +117,20 @@ static PHP_INI_MH(OnUpdateSerializer) return SUCCESS; } +static PHP_INI_MH(OnUpdateSaveDir) { + /* Only do the safemode/open_basedir check at runtime */ + if(stage == PHP_INI_STAGE_RUNTIME) { + if (PG(safe_mode) && (!php_checkuid(new_value, NULL, CHECKUID_ALLOW_ONLY_DIR))) { + return FAILURE; + } + + if (php_check_open_basedir(new_value TSRMLS_CC)) { + return FAILURE; + } + } + OnUpdateString(entry, new_value, new_value_length, mh_arg1, mh_arg2, mh_arg3, stage TSRMLS_CC); + return SUCCESS; +} /* {{{ PHP_INI */ @@ -124,9 +138,9 @@ PHP_INI_BEGIN() STD_PHP_INI_BOOLEAN("session.bug_compat_42", "1", PHP_INI_ALL, OnUpdateBool, bug_compat, php_ps_glo bals, ps_globals) STD_PHP_INI_BOOLEAN("session.bug_compat_warn", "1", PHP_INI_ALL, OnUpdateBool, bug_compat_warn, php_ps_glo bals, ps_globals) #ifdef PHP_WIN32 - STD_PHP_INI_ENTRY("session.save_path", "", PHP_INI_ALL, OnUpdateString, save_path, php_ps_globals , ps_globals) + STD_PHP_INI_ENTRY("session.save_path", "", PHP_INI_ALL, OnUpdateSaveDir,save_path, php_ps_glo bals, ps_globals) #else - STD_PHP_INI_ENTRY("session.save_path", "/tmp", PHP_INI_ALL, OnUpdateString, save_path, php_ps_glo bals, ps_globals) + STD_PHP_INI_ENTRY("session.save_path", "/tmp", PHP_INI_ALL, OnUpdateSaveDir,save_path, php_ps_glo bals, ps_globals) #endif STD_PHP_INI_ENTRY("session.name", "PHPSESSID", PHP_INI_ALL, OnUpdateString, session_name, php_ps_glo bals, ps_globals) PHP_INI_ENTRY("session.save_handler", "files", PHP_INI_ALL, OnUpdateSaveHandler)