open_basedir bypass View as Markdown

Am 28.09.2011 09:28, schrieb Pierre Joye:

$tmp_name = str_replace("\", '/', tempnam($temp_folder, 'rhcsv'));

Side note: this is never necessary, php does it for you. Unless you
store paths yourself before calling a php file function

i know

this is my way to make sure that even on windows there are never
backslashes used and probably translations from realpaths to
urls are failing because of that

Am 28.09.2011 10:46, schrieb Pierre Joye:

hi,

First, all you need to test is:

$tempfile = tempnam($temp_folder, 'rhcsv');
$fp = fopen($tempfile , 'w');

• /tmp MUST NOT be in open_basedir
• the temp-folder must be read only
• QUESTION1: why is tempnam() falling back to a dir outside open_basedir?
• QUESTION2: why is tempnam() creating a file OUTSIDE open_basedir?

The flow can be easily seen here:

http://lxr.php.net/opengrok/xref/PHP_5_4/ext/standard/file.c#798
http://lxr.php.net/xref/PHP_5_4/main/php_open_temporary_file.c#php_do_open_temporary_file

• QUESTION3: why is there no error-msg taht $dir is readonly instead unexpected fallback

It is how it always work for temp files. Configure the temp
directories correctly is the way to go (set the TMP). As far as I
remember there was a discussion about temp directories and open base
dir a while back, maybe you can find some additional info in it.

but it is wrong to create a file outside the open_basedir especially
if a full qualified directory was passed where it should be created

without any param /tmp is right but not as magical fallback and in
my opinion a well desigend webapp should never touch global /tmp
shared with other hosts and applications

Am 28.09.2011 17:03, schrieb Ferenc Kovacs:

please configure the mailing-list correct
please add a hint that modern clients have a "reply-to-list"

for the record, I don't have that in gmail.

please add a hint that the sender should be removed after
reply-all because "internals@lists.php.net" is reaching the
list AND the sender of the post where you write your answer

and what if the sender is not subscribed to the list?

then he can usually not send to a list

I don't get two emails in gmail, I don't know that the list is smart
enough to not send emails those who are to or cc'ed, or maybe it's a
gmail feature.

you get them not if the person who answered was smart enough
to use "reply to list" or deleted the second address

using "reply-to-list" will only answer to the mailinglist
this is why the following headers exists

list-help: mailto:internals-help@lists.php.net
list-unsubscribe: mailto:internals-unsubscribe@lists.php.net
list-post: mailto:internals@lists.php.net
List-Id: internals.lists.php.net

thats not the main reason why those headers exists AFAIK, but I agree
that it could be used for reply-to-list

as I mentioned before, nobody knows every participant in the list, so
if you reply someone, it is better to not only send it to the list.but
to that person also, because you don't know that he is on the list or
not.

normally you have to subscribe for sending to a list and i would wonder
if every spambot can anonymously post to php-devel, so if somebody sends
to the list he also receives it

Am 28.09.2011 17:05, schrieb Rasmus Lerdorf:

Reindl, please read http://www.unicom.com/pw/reply-to-harmful.html
The list is configured correctly

well and there i read the text below

and that was the reason why i said last night PLEASE reply only to the
list because i need not every message twice and answering to the
wrong duplicate leaves the list out, one of you both mails has "reply to list"
and the other copy not, if i use the other copy you get a lonely answer
leaving the list out of rcpt

But it already is easy. Reasonable mail programs have two separate "reply" commands:
one that replies directly to the author of a message, and another that replies to the
author plus all of the list recipients. Even the lowly Berkeley Mail command has had
this for about a decade.

Ferenc Kovacs wrote:

well if there would be used "Reply-To"-Headers
tell me ONE reason to get every answer twice
I don't get two emails in gmail, I don't know that the list is smart
enough to not send emails those who are to or cc'ed, or maybe it's a
gmail feature.

That's a gmail (mis)feature.
If you receive an email twice, it is collapsed into one.

A benefit of being addressed in the email that hasn't been mentioned yet,
is that some people use that for email filtering, marking higher emails
that
are set to them. It is popular for instance among developers of linux
kernel,
where they don't usually read the very active list (lkml), so you are
requested
to email the list and CC the people that is likely to be interested in
that field.
Even though those people are subscribed to the list, they are not reading
all of it.