php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #77317 __DIR__, __FILE__, realpath() reveal physical path for subst virtual drive
Submitted: 2018-12-18 19:51 UTC Modified: 2019-03-07 14:30 UTC
Votes:1
Avg. Score:5.0 ± 0.0
Reproduced:1 of 1 (100.0%)
Same Version:1 (100.0%)
Same OS:1 (100.0%)
From: mtanalin at yandex dot ru Assigned: ab (profile)
Status: Closed Package: *Directory/Filesystem functions
PHP Version: 7.3.0 OS: Windows 10
Private report: No CVE-ID: None
 [2018-12-18 19:51 UTC] mtanalin at yandex dot ru
Description:
------------
`__DIR__`, `__FILE__` and `realpath()` now reveal physical path for virtual drives created with `subst` under Windows. This is a breaking backward-incompatible change.

The Windows’ built-in `subst` application maps a physical directory to a virtual drive and is used by Denwer for creating a virtual drive that web servers are virtually located on. Denwer is a WAMP kit popular in Russia.

Documentation pages for `__DIR__`, `__FILE__` and `realpath()` have no information about this change.

PHP 7.2.12 works as expected: virtual-drive path is returned, physical path is not revealed.

So either the behavior in PHP 7.3.x should be the same as in PHP 7.2.x (virtual-drive path returned, physical-drive path not revealed), or this breaking change should be documented.

For example, in PHP 7.3.0 (with the latest Apache 2.4.37 [2018-11-21] from Apache Lounge):

	__DIR__:
		D:\_webservers\home\test-host

	__FILE__:
		D:\_webservers\home\test-host\test.php

	$_SERVER['DOCUMENT_ROOT']:
		Z:/home/test-host/www

	realpath($_SERVER['DOCUMENT_ROOT']):
		D:\_webservers\home\test-host\www

While in PHP 7.2.12:

	__DIR__:
		Z:\home\test-host

	__FILE__:
		Z:\home\test-host\test.php

	$_SERVER['DOCUMENT_ROOT']:
		Z:/home/test-host/www

	realpath($_SERVER['DOCUMENT_ROOT']):
		Z:\home\test-host\www


Test script:
---------------
<?php

echo __DIR__ . '<br>'
   . __FILE__ . '<br>'
   . $_SERVER['DOCUMENT_ROOT'] . '<br>'
   . realpath($_SERVER['DOCUMENT_ROOT']);


Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2018-12-21 22:57 UTC] cmb@php.net
-Status: Open +Status: Assigned -Assigned To: +Assigned To: ab
 [2018-12-21 22:57 UTC] cmb@php.net
The behavioral change has been introduced with commit f3f6cd2[1].
It seems to me that this change is intentional.  Anatol, if I'm
right, please assign back to me, and I'll add a respective note to
upgrading and the migration guide.

[1] <http://git.php.net/?p=php-src.git;a=commit;h=f3f6cd24e9677c820f198f3804d6c9a932685373>
 [2018-12-24 17:12 UTC] ab@php.net
Thanks for the ping, Christoph. Yes, the intention was to move to a faster API. I think though, the reported behavior change needs to be fixed to comply with realpath(3) and earlier PHP. That would make the initial patch somewhat slower unfortunately. Perhaps this could be revisited in later PHP versions, by introducing a Windows specific routine or another way. I'll be working on a patch, otherwise we can also disable the quick path handling but keep the new internal realpath API.

Thanks.
 [2018-12-26 12:07 UTC] ab@php.net
Automatic comment on behalf of ab
Revision: http://git.php.net/?p=php-src.git;a=commit;h=199914b42dccae1c87212dac988b14f57969652d
Log: Fixed bug #77317 __DIR__, __FILE__, realpath() reveal physical path for subst virtual drive
 [2018-12-26 12:07 UTC] ab@php.net
-Status: Assigned +Status: Closed
 [2019-01-11 21:18 UTC] mtanalin at yandex dot ru
The recent PHP 7.3.1 is still affected. When is the fix going to be applied to stable branch? Thanks.
 [2019-03-07 14:30 UTC] mtanalin at yandex dot ru
Fixed in PHP 7.3.2+. Thanks.
 
PHP Copyright © 2001-2019 The PHP Group
All rights reserved.
Last updated: Wed Sep 18 09:01:27 2019 UTC