Newsgroups: php.internals Path: news.php.net Xref: news.php.net php.internals:55650 Return-Path: Mailing-List: contact internals-help@lists.php.net; run by ezmlm Delivered-To: mailing list internals@lists.php.net Received: (qmail 76262 invoked from network); 28 Sep 2011 09:09:35 -0000 Received: from unknown (HELO lists.php.net) (127.0.0.1) by localhost with SMTP; 28 Sep 2011 09:09:35 -0000 Authentication-Results: pb1.pair.com smtp.mail=h.reindl@thelounge.net; spf=pass; sender-id=pass Authentication-Results: pb1.pair.com header.from=h.reindl@thelounge.net; sender-id=pass Received-SPF: pass (pb1.pair.com: domain thelounge.net designates 91.118.73.15 as permitted sender) X-PHP-List-Original-Sender: h.reindl@thelounge.net X-Host-Fingerprint: 91.118.73.15 mail.thelounge.net Windows 98 (1) Received: from [91.118.73.15] ([91.118.73.15:49367] helo=mail.thelounge.net) by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP id E7/92-62163-E44E28E4 for ; Wed, 28 Sep 2011 05:09:34 -0400 Received: from rh.thelounge.net (rh.thelounge.net [10.0.0.99]) (using TLSv1 with cipher DHE-RSA-CAMELLIA256-SHA (256/256 bits)) (No client certificate requested) by mail.thelounge.net (Postfix) with ESMTPSA id 4F7CC98 for ; Wed, 28 Sep 2011 11:09:31 +0200 (CEST) Message-ID: <4E82E44B.2090402@thelounge.net> Date: Wed, 28 Sep 2011 11:09:31 +0200 Organization: the lounge interactive design User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:6.0.2) Gecko/20110906 Thunderbird/6.0.2 MIME-Version: 1.0 To: internals@lists.php.net References: <4E81902E.1020304@thelounge.net> <4E824B36.4040209@gmail.com> <4E824BF7.9070405@thelounge.net> <4E824F69.1010703@gmail.com> <4E825084.4040703@thelounge.net> <4E82B825.5060003@daylessday.org> <4E82C679.9030800@thelounge.net> <4E82DFBE.7000701@thelounge.net> In-Reply-To: X-Enigmail-Version: 1.3.2 OpenPGP: id=7F780279; url=http://arrakis.thelounge.net/gpg/h.reindl_thelounge.net.pub.txt Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="------------enig7023255B7231A9AE852455B7" Subject: Re: [PHP-DEV] open_basedir bypass -> errata tempnam() From: h.reindl@thelounge.net (Reindl Harald) --------------enig7023255B7231A9AE852455B7 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Am 28.09.2011 10:53, schrieb Pierre Joye: On Wed, Sep 28, 2011 at 10:50 AM, Reindl Harald = wrote: > without any param /tmp is right but not as magical fallback and in > my opinion a well desigend webapp should never touch global /tmp > shared with other hosts and applications Well, a well configured shared host has correct temporary directory set. In any case, please open a bug at bugs.php.net so we can follow this possible more closely. Please use the very simply script I use as it is all we need to debug it. well, temporary directory must not matter if path is explicit passed via = param https://bugs.php.net/bug.php?id=3D55804 > Forgot to mention that this behavior is clearly documented: > http://www.php.net/tempnam > So it is not sure that we will fix that any time soon. documentation makes wrong behavior not right fact is that a php-function must not create files outside open_basedir with only two eexceptions which are for security reasons * session save path (must not be in open_basedir) * upload dir (must not be in open_basedir) --------------enig7023255B7231A9AE852455B7 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAk6C5EsACgkQhmBjz394AnlPAQCgjRrpV/yLGejfaSMukIBBnNmP f6QAn1AucET6CYh3rWiHSj1ZffRv5we+ =Uk/u -----END PGP SIGNATURE----- --------------enig7023255B7231A9AE852455B7--