mirrors/php-src
0
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2024-11-24 10:24:11 +08:00
Code Issues Packages Projects Releases Wiki Activity

- I wrote a long msg but the commit didn't go through.

Browse Source 
- So here is the short version:
- a) Start moving to binary opens in Windows
- b) Give checkuid_mode() a small face lift including the fopen-wrappers.c
- The mode to this function should at least be a #define but that is for
- another day. Anyway this whole stuff should be given more face lifts in
- the future.
This commit is contained in:
Zeev Suraski 2000-06-25 17:02:59 +00:00
parent ba69d9958d
commit 6614e8edb4
14 changed files with 43 additions and 51 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
ext/db/db.c
View File

@ -289,7 +289,7 @@ dbm_info *php_dbm_open(char *filename, char *mode) {
return NULL;
}
if (PG(safe_mode) && (!php_checkuid(filename, 2))) {
if (PG(safe_mode) && (!php_checkuid(filename, NULL, 2))) {
return NULL;
}

4
ext/dbase/dbase.c
View File

@ -120,7 +120,7 @@ PHP_FUNCTION(dbase_open) {
convert_to_string(dbf_name);
convert_to_long(options);
if (PG(safe_mode) && (!php_checkuid(dbf_name->value.str.val, 2))) {
if (PG(safe_mode) && (!php_checkuid(dbf_name->value.str.val, NULL, 2))) {
RETURN_FALSE;
}
@ -583,7 +583,7 @@ PHP_FUNCTION(dbase_create) {
RETURN_FALSE;
}
if (PG(safe_mode) && (!php_checkuid(Z_STRVAL_P(filename), 2))) {
if (PG(safe_mode) && (!php_checkuid(Z_STRVAL_P(filename), NULL, 2))) {
RETURN_FALSE;
}

6
ext/filepro/filepro.c
View File

@ -203,7 +203,7 @@ PHP_FUNCTION(filepro)
sprintf(workbuf, "%s/map", dir->value.str.val);
if (PG(safe_mode) && (!php_checkuid(workbuf, 2))) {
if (PG(safe_mode) && (!php_checkuid(workbuf, NULL, 2))) {
RETURN_FALSE;
}
@ -302,7 +302,7 @@ PHP_FUNCTION(filepro_rowcount)
/* Now read the records in, moving forward recsize-1 bytes each time */
sprintf(workbuf, "%s/key", FP_GLOBAL(fp_database));
if (PG(safe_mode) && (!php_checkuid(workbuf, 2))) {
if (PG(safe_mode) && (!php_checkuid(workbuf, NULL, 2))) {
RETURN_FALSE;
}
@ -527,7 +527,7 @@ PHP_FUNCTION(filepro_retrieve)
/* Now read the record in */
sprintf(workbuf, "%s/key", FP_GLOBAL(fp_database));
if (PG(safe_mode) && (!php_checkuid(workbuf, 2))) {
if (PG(safe_mode) && (!php_checkuid(workbuf, NULL, 2))) {
RETURN_FALSE;
}

2
ext/pgsql/pgsql.c
View File

@ -1539,7 +1539,7 @@ PHP_FUNCTION(pg_loimport)
break;
}
if (PG(safe_mode) &&(!php_checkuid(Z_STRVAL_PP(file_in), 2))) {
if (PG(safe_mode) &&(!php_checkuid(Z_STRVAL_PP(file_in), NULL, 2))) {
RETURN_FALSE;
}

2
ext/posix/posix.c
View File

@ -603,7 +603,7 @@ PHP_FUNCTION(posix_mkfifo)
convert_to_string(path);
convert_to_long(mode);
if (php3_ini.safe_mode && (!php_checkuid(path->value.str.val, 3))) {
if (php3_ini.safe_mode && (!php_checkuid(path->value.str.val, NULL, 3))) {
RETURN_FALSE;
}
result = mkfifo(path->value.str.val, mode->value.lval);

8
ext/standard/exec.c
View File

@ -86,11 +86,7 @@ static int _Exec(int type, char *cmd, pval *array, pval *return_value)
tmp = php_escape_shell_cmd(d);
efree(d);
d = tmp;
#ifdef PHP_WIN32
fp = V_POPEN(d, "rb");
#else
fp = V_POPEN(d, "r");
#endif
if (!fp) {
php_error(E_WARNING, "Unable to fork [%s]", d);
efree(d);
@ -98,11 +94,7 @@ static int _Exec(int type, char *cmd, pval *array, pval *return_value)
return -1;
}
} else { /* not safe_mode */
#ifdef PHP_WIN32
fp = V_POPEN(cmd, "rb");
#else
fp = V_POPEN(cmd, "r");
#endif
if (!fp) {
php_error(E_WARNING, "Unable to fork [%s]", cmd);
efree(buf);

8
ext/standard/file.c
View File

@ -1344,7 +1344,7 @@ PHP_FUNCTION(mkdir)
convert_to_string_ex(arg1);
convert_to_long_ex(arg2);
mode = (*arg2)->value.lval;
if (PG(safe_mode) &&(!php_checkuid((*arg1)->value.str.val,3))) {
if (PG(safe_mode) &&(!php_checkuid((*arg1)->value.str.val, NULL, 3))) {
RETURN_FALSE;
}
ret = V_MKDIR((*arg1)->value.str.val,mode);
@ -1369,7 +1369,7 @@ PHP_FUNCTION(rmdir)
WRONG_PARAM_COUNT;
}
convert_to_string_ex(arg1);
if (PG(safe_mode) &&(!php_checkuid((*arg1)->value.str.val,1))) {
if (PG(safe_mode) &&(!php_checkuid((*arg1)->value.str.val, NULL, 1))) {
RETURN_FALSE;
}
ret = rmdir((*arg1)->value.str.val);
@ -1563,7 +1563,7 @@ PHP_FUNCTION(rename)
old_name = (*old_arg)->value.str.val;
new_name = (*new_arg)->value.str.val;
if (PG(safe_mode) &&(!php_checkuid(old_name, 2))) {
if (PG(safe_mode) &&(!php_checkuid(old_name, NULL, 2))) {
RETURN_FALSE;
}
ret = rename(old_name, new_name);
@ -1669,7 +1669,7 @@ PHP_FUNCTION(copy)
convert_to_string_ex(source);
convert_to_string_ex(target);
if (PG(safe_mode) &&(!php_checkuid((*source)->value.str.val,2))) {
if (PG(safe_mode) &&(!php_checkuid((*source)->value.str.val, NULL, 2))) {
RETURN_FALSE;
}

8
ext/standard/filestat.c
View File

@ -252,7 +252,7 @@ PHP_FUNCTION(chgrp)
gid = (*group)->value.lval;
}
if (PG(safe_mode) &&(!php_checkuid((*filename)->value.str.val,1))) {
if (PG(safe_mode) &&(!php_checkuid((*filename)->value.str.val, NULL, 1))) {
RETURN_FALSE;
}
@ -300,7 +300,7 @@ PHP_FUNCTION(chown)
uid = (*user)->value.lval;
}
if (PG(safe_mode) &&(!php_checkuid((*filename)->value.str.val,1))) {
if (PG(safe_mode) &&(!php_checkuid((*filename)->value.str.val, NULL, 1))) {
RETURN_FALSE;
}
@ -333,7 +333,7 @@ PHP_FUNCTION(chmod)
convert_to_string_ex(filename);
convert_to_long_ex(mode);
if (PG(safe_mode) &&(!php_checkuid((*filename)->value.str.val,1))) {
if (PG(safe_mode) &&(!php_checkuid((*filename)->value.str.val, NULL, 1))) {
RETURN_FALSE;
}
@ -396,7 +396,7 @@ PHP_FUNCTION(touch)
}
convert_to_string_ex(filename);
if (PG(safe_mode) &&(!php_checkuid((*filename)->value.str.val,1))) {
if (PG(safe_mode) &&(!php_checkuid((*filename)->value.str.val, NULL, 1))) {
if (newtime) efree(newtime);
RETURN_FALSE;
}

6
ext/standard/link.c
View File

@ -110,7 +110,7 @@ PHP_FUNCTION(symlink)
convert_to_string_ex(topath);
convert_to_string_ex(frompath);
if (PG(safe_mode) && !php_checkuid((*topath)->value.str.val, 2)) {
if (PG(safe_mode) && !php_checkuid((*topath)->value.str.val, NULL, 2)) {
RETURN_FALSE;
}
if (!strncasecmp((*topath)->value.str.val,"http://",7) || !strncasecmp((*topath)->value.str.val,"ftp://",6)) {
@ -141,7 +141,7 @@ PHP_FUNCTION(link)
convert_to_string_ex(topath);
convert_to_string_ex(frompath);
if (PG(safe_mode) && !php_checkuid((*topath)->value.str.val, 2)) {
if (PG(safe_mode) && !php_checkuid((*topath)->value.str.val, NULL, 2)) {
RETURN_FALSE;
}
if (!strncasecmp((*topath)->value.str.val,"http://",7) || !strncasecmp((*topath)->value.str.val,"ftp://",6)) {
@ -171,7 +171,7 @@ PHP_FUNCTION(unlink)
}
convert_to_string_ex(filename);
if (PG(safe_mode) && !php_checkuid((*filename)->value.str.val, 2)) {
if (PG(safe_mode) && !php_checkuid((*filename)->value.str.val, NULL, 2)) {
RETURN_FALSE;
}

10
ext/zlib/zlib.c
View File

@ -160,7 +160,7 @@ static gzFile php_gzopen_wrapper(char *path, char *mode, int options)
return php_gzopen_with_path(path, mode, PG(include_path), NULL);
}
else {
if (options & ENFORCE_SAFE_MODE && PG(safe_mode) && (!php_checkuid(path,1))) {
if (options & ENFORCE_SAFE_MODE && PG(safe_mode) && (!php_checkuid(path, NULL, 1))) {
return NULL;
}
if (php_check_open_basedir(path)) return NULL;
@ -186,7 +186,7 @@ static gzFile *php_gzopen_with_path(char *filename, char *mode, char *path, char
/* Relative path open */
if (*filename == '.') {
if (PG(safe_mode) &&(!php_checkuid(filename,2))) {
if (PG(safe_mode) &&(!php_checkuid(filename, NULL, 2))) {
return(NULL);
}
if (php_check_open_basedir(filename)) return NULL;
@ -209,7 +209,7 @@ static gzFile *php_gzopen_with_path(char *filename, char *mode, char *path, char
} else {
strlcpy(trypath,filename,sizeof(trypath));
}
if (!php_checkuid(trypath,2)) {
if (!php_checkuid(trypath, NULL, 2)) {
return(NULL);
}
if (php_check_open_basedir(trypath)) return NULL;
@ -225,7 +225,7 @@ static gzFile *php_gzopen_with_path(char *filename, char *mode, char *path, char
}
if (!path || (path && !*path)) {
if (PG(safe_mode) &&(!php_checkuid(filename,2))) {
if (PG(safe_mode) &&(!php_checkuid(filename, NULL, 2))) {
return(NULL);
}
if (php_check_open_basedir(filename)) return NULL;
@ -252,7 +252,7 @@ static gzFile *php_gzopen_with_path(char *filename, char *mode, char *path, char
}
snprintf(trypath, MAXPATHLEN, "%s/%s", ptr, filename);
if (PG(safe_mode)) {
if (V_STAT(trypath,&sb) == 0 &&(!php_checkuid(trypath,2))) {
if (V_STAT(trypath,&sb) == 0 &&(!php_checkuid(trypath, NULL, 2))) {
efree(pathbuf);
return(NULL);
}

22
main/fopen_wrappers.c
View File

@ -246,7 +246,6 @@ PHPAPI int php_check_open_basedir(char *path)
PHPAPI FILE *php_fopen_wrapper(char *path, char *mode, int options, int *issock, int *socketd, char **opened_path)
{
int cm=2; /* checkuid mode: 2 = if file does not exist, check directory */
PLS_FETCH();
if (opened_path) {
@ -266,10 +265,7 @@ PHPAPI FILE *php_fopen_wrapper(char *path, char *mode, int options, int *issock,
} else {
FILE *fp;
if (!strcmp(mode,"r") || !strcmp(mode,"r+")) {
cm=0;
}
if (options & ENFORCE_SAFE_MODE && PG(safe_mode) && (!php_checkuid(path, cm))) {
if (options & ENFORCE_SAFE_MODE && PG(safe_mode) && (!php_checkuid(path, mode, 0))) {
return NULL;
}
if (php_check_open_basedir(path)) {
@ -358,7 +354,7 @@ PHPAPI FILE *php_fopen_primary_script(void)
SG(request_info).path_translated = NULL;
return NULL;
}
fp = V_FOPEN(filename, "r");
fp = V_FOPEN(filename, "rb");
/* refuse to open anything that is not a regular file */
if (fp && (0 > fstat(fileno(fp), &st) || !S_ISREG(st.st_mode))) {
@ -393,17 +389,15 @@ PHPAPI FILE *php_fopen_with_path(char *filename, char *mode, char *path, char **
char trypath[MAXPATHLEN + 1];
struct stat sb;
FILE *fp;
int cm=2;
PLS_FETCH();
if (opened_path) {
*opened_path = NULL;
}
if(!strcmp(mode,"r") || !strcmp(mode,"r+")) cm=0;
/* Relative path open */
if (*filename == '.') {
if (PG(safe_mode) && (!php_checkuid(filename, cm))) {
if (PG(safe_mode) && (!php_checkuid(filename, mode, 0))) {
return NULL;
}
if (php_check_open_basedir(filename)) return NULL;
@ -425,7 +419,7 @@ PHPAPI FILE *php_fopen_with_path(char *filename, char *mode, char *path, char **
} else {
strlcpy(trypath,filename,sizeof(trypath));
}
if (!php_checkuid(trypath, cm)) {
if (!php_checkuid(trypath, mode, 0)) {
return NULL;
}
if (php_check_open_basedir(trypath)) return NULL;
@ -446,7 +440,7 @@ PHPAPI FILE *php_fopen_with_path(char *filename, char *mode, char *path, char **
}
}
if (!path || (path && !*path)) {
if (PG(safe_mode) && (!php_checkuid(filename, cm))) {
if (PG(safe_mode) && (!php_checkuid(filename, mode, 0))) {
return NULL;
}
if (php_check_open_basedir(filename)) {
@ -474,7 +468,7 @@ PHPAPI FILE *php_fopen_with_path(char *filename, char *mode, char *path, char **
}
snprintf(trypath, MAXPATHLEN, "%s/%s", ptr, filename);
if (PG(safe_mode)) {
if (V_STAT(trypath, &sb) == 0 && (!php_checkuid(trypath, cm))) {
if (V_STAT(trypath, &sb) == 0 && (!php_checkuid(trypath, mode, 0))) {
efree(pathbuf);
return NULL;
}
@ -1032,9 +1026,7 @@ static FILE *php_fopen_url_wrapper(const char *path, char *mode, int options, in
if (options & USE_PATH) {
fp = php_fopen_with_path((char *) path, mode, PG(include_path), opened_path);
} else {
int cm=2;
if(!strcmp(mode,"r") || !strcmp(mode,"r+")) cm=0;
if (options & ENFORCE_SAFE_MODE && PG(safe_mode) && (!php_checkuid(path, cm))) {
if (options & ENFORCE_SAFE_MODE && PG(safe_mode) && (!php_checkuid(path, mode, 0))) {
fp = NULL;
} else {
if (php_check_open_basedir((char *) path)) {

4
main/main.c
View File

@ -493,11 +493,11 @@ static FILE *php_fopen_wrapper_for_zend(const char *filename, char **opened_path
FILE *retval;
old_chunk_size = php_sock_set_def_chunk_size(1);
retval=php_fopen_wrapper((char *) filename, "r", USE_PATH|IGNORE_URL_WIN, &issock, &socketd, opened_path);
retval=php_fopen_wrapper((char *) filename, "rb", USE_PATH|IGNORE_URL_WIN, &issock, &socketd, opened_path);
php_sock_set_def_chunk_size(old_chunk_size);
if (issock) {
retval = fdopen(socketd, "r");
retval = fdopen(socketd, "rb");
}
return retval;
}

10
main/safe_mode.c
View File

@ -40,7 +40,7 @@
* 2 - if file does not exist, check directory
* 3 - only check directory (needed for mkdir)
*/
PHPAPI int php_checkuid(const char *fn, int mode) {
PHPAPI int php_checkuid(const char *fn, char *fopen_mode, int mode) {
struct stat sb;
int ret;
long uid=0L, duid=0L;
@ -48,6 +48,14 @@ PHPAPI int php_checkuid(const char *fn, int mode) {
if (!fn) return(0); /* path must be provided */
if (fopen_mode) {
if (fopen_mode[0] == 'r') {
mode = 0;
} else {
mode = 2;
}
}
/*
* If given filepath is a URL, allow - safe mode stuff
* related to URL's is checked in individual functions

2
main/safe_mode.h
View File

@ -1,7 +1,7 @@
#ifndef _SAFE_MODE_H_
#define _SAFE_MODE_H_
extern PHPAPI int php_checkuid(const char *filename, int mode);
extern PHPAPI int php_checkuid(const char *filename, char *fopen_mode, int mode);
extern PHPAPI char *php_get_current_user(void);
#endif