Newsgroups: php.internals Path: news.php.net Xref: news.php.net php.internals:13105 Return-Path: Mailing-List: contact internals-help@lists.php.net; run by ezmlm Delivered-To: mailing list internals@lists.php.net Received: (qmail 18378 invoked by uid 1010); 1 Oct 2004 19:36:52 -0000 Delivered-To: ezmlm-scan-internals@lists.php.net Delivered-To: ezmlm-internals@lists.php.net Received: (qmail 18319 invoked from network); 1 Oct 2004 19:36:51 -0000 Received: from unknown (HELO calmail-fe1.berkeley.edu) (128.32.61.106) by pb1.pair.com with SMTP; 1 Oct 2004 19:36:51 -0000 Received: from [169.229.135.175] (account saramg@calmail.berkeley.edu HELO warbler) by calmail-fe1.berkeley.edu (CommuniGate Pro SMTP 4.1.8) with ESMTP-TLS id 34790119; Fri, 01 Oct 2004 12:36:51 -0700 Message-ID: <008701c4a7ed$ffd58e90$af87e5a9@ohr.berkeley.edu> To: "Rasmus Lerdorf" , "Andi Gutmans" Cc: References: <5.1.0.14.2.20040930225715.02f0e4b0@localhost> <5.1.0.14.2.20041001113226.02efa7e0@localhost> Date: Fri, 1 Oct 2004 12:36:50 -0700 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1437 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1441 Subject: Re: [PHP-DEV] Re: realpath patch From: saramg@berkeley.edu ("Sara Golemon") > With safemode on they can't do this symlink trick directly from > php because PHP's symlink() safemode checks source and target paths. > Good call... > The > only case that trips us up is the one where a user has direct access to > create whatever symlinks he wants in his own directory and then by hitting > that symlink through the web server he is effectively reading any file the > web server user id has permission to read and thereby bypassing safemode. > I wouldn't consider it uncommon for shared hosting users to have a shell account.... > But like my syscall patches, realpath caching isn't something all that > many really need. Turning it off when safemode/open_basedir is on should > be fine. > I can agree with that. Even though the caching would be a real "nice-to-have". It's much cleaner to just disable it in cases where it'll cause more harm than good. I *do* want to point out that the current form of the patch won't build under ZTS though. virtual_file_ex has no TSRMLS_DC in its declaration but it makes use of CWDG(). -Sara