Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:55639
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain thelounge.net designates 91.118.73.15 as permitted sender)
Message-ID: <4E824BF7.9070405@thelounge.net>
Date: Wed, 28 Sep 2011 00:19:35 +0200
Organization: the lounge interactive design
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:6.0.2) Gecko/20110906 Thunderbird/6.0.2
MIME-Version: 1.0
To: internals@lists.php.net
References: <4E81902E.1020304@thelounge.net> <4E824B36.4040209@gmail.com>
In-Reply-To: <4E824B36.4040209@gmail.com>
OpenPGP: id=7F780279;
	url=http://arrakis.thelounge.net/gpg/h.reindl_thelounge.net.pub.txt
Content-Type: multipart/signed; micalg=pgp-sha1;
 protocol="application/pgp-signature";
 boundary="------------enig6A19AD806A03DD92F27B434B"
Subject: Re: [PHP-DEV] open_basedir bypass -> errata tempnam()
From: h.reindl@thelounge.net (Reindl Harald)

--------------enig6A19AD806A03DD92F27B434B
Content-Type: text/plain; charset=windows-1252
Content-Transfer-Encoding: quoted-printable



Am 28.09.2011 00:16, schrieb =C1ngel Gonz=E1lez:
> Reindl Harald wrote:
>> below a correct open_basedir restriction
>>
>> but why can fopen() create this file outside the
>> basedir and after that the restriction is active?
>>
>> this means in other words: fopen() can empty files outside the basedir=

>> if their permissions are open enough
>>
>> Sep 27 10:53:26 open_basedir restriction in effect. File(/tmp/rhcsvz8Q=
eBL) is not within the allowed path(s):
>> (/etc/httpd/conf/panel:/Volumes/dune/www-servers/phpincludes:/usr/shar=
e/pear)
>> Sep 27 10:53:26 PHP Warning: fopen(/tmp/rhcsvz8QeBL): failed to open s=
tream: Operation not permitted in
>> /Volumes/dune/www-servers/phpincludes/global_rh_csv.inc.php on line 2
>>
>> [root@arrakis:~]$ stat /tmp/rhcsvz8QeBL
>>    File: =84/tmp/rhcsvz8QeBL=93
> Are you sure it is the fopen() what is making it?
> I think that some other function/extension may be creating the temporar=
y file
> /tmp/rhcsvz8QeBL for you to open, which then fails due to the open_base=
dir.

errata - it is tempnam() if $dir is not writeable which falls back to /tm=
p
this fallback should not happen if /tmp is NOT in open_basedir and
tempname() should spit out the error instead the following fopen()

better would be if tempnam() stops and gives out a warning that $dir is
not writeable - it had a reason that the $dir param was used and if
there is an error it is a bad behavior that php takes something else

we are speaking about a programming language and not a gambling machine :=
-)


--------------enig6A19AD806A03DD92F27B434B
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk6CS/cACgkQhmBjz394Ank2LgCeLMXxP2rBkPdWoGVaft5cvsun
XagAn1RfApnVlLvzvGAZmpa9SxSIEPqC
=jzHy
-----END PGP SIGNATURE-----

--------------enig6A19AD806A03DD92F27B434B--