|
|
php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login |
[2007-02-02 15:22 UTC] sborrill at precedence dot co dot uk
Description:
------------
With PHP versions prior to 5.2.0 (e.g. 5.1.6), you could fopen() a file in the current working directory (i.e. same as the script) even if a parent directory only had +x permission and not +rx for the webserver. With 5.2.0 (and today's 5.2 snapshot) you get "Warning: fopen(file) [function.fopen]: failed to open stream: No such file or directory [...]".
If it's of any relevance, with all versions, getcwd() returns FALSE on NetBSD if a parent folder is not readable, but this does not affect fopen().
This is affecting any user whose home area is mode 0711 when they run php from their public_html folder (which is mode 0755).
Reproduce code:
---------------
Ensuring ownership is not same as web server process (e.g. in public_html in user's home area):
mkdir one
mkdir one/two
chmod 711 one
chmod 755 one/two
echo "test" > one/two/testfile
one/two/index.php contains:
<?php
echo "cwd:".getcwd()."<br>";
$fp=fopen("testfile","r");
if($fp) fpassthru($fp);
?>
Stage one:
chmod 711 one
Stage two:
chmod 755 one
Expected result:
----------------
(stage one):
cwd:
test
(stage two)
cwd: /home/testuser/public_html
test
Actual result:
--------------
(stage 1):
cwd:
Warning: fopen(file) [function.fopen]: failed to open stream: No such file or directory [...]
(stage two)
cwd: /home/testuser/public_html
test
PatchesPull RequestsHistoryAllCommentsChangesGit/SVN commits
|
|||||||||||||||||||||||||||||||||||||
Copyright © 2001-2024 The PHP GroupAll rights reserved. |
Last updated: Thu Oct 03 13:01:26 2024 UTC |
What sort of account? FTP/ssh/something else? Alternatively, big thanks to tlaramie at superb dot net for offering a suitable account. The error was introduced in revision 1.74.2.9.2.4 and is around line 584 for TSRM/tsrm_virtual_cwd.c in the loop that begins: ptr = tsrm_strtok_r(path_copy, TOKENIZER_STRING, &tok); This loop is not run in 1.74.2.9.2.3 if the cwdlen is 0. With 1.74.2.9.2.4 and later it is always run and so prepends a / on the file name, i.e. the actual file that is opened with fopen("file","r") is "/file". This strikes me as a potential security problem too.