From bcf354a97ae7f5f2764a8e713c29c7c8683797a4 Mon Sep 17 00:00:00 2001 From: Ilia Alshanetsky Date: Wed, 5 Oct 2005 14:35:30 +0000 Subject: [PATCH] MFH: Missing safe_mode/open_basedir checks for file uploads. --- NEWS | 1 + ext/curl/interface.c | 7 ++++++- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/NEWS b/NEWS index 536b6338195..785c56f1e9e 100644 --- a/NEWS +++ b/NEWS @@ -30,6 +30,7 @@ PHP NEWS . ext/oracle (Jani, Derick) . ext/ovrimos (Jani, Derick, Pierre) . ext/pfpro (Jani, Derick, Pierre) +- Added missing safe_mode/open_basedir checks for file uploads. (Ilia) - Fixed possible INI setting leak via virtual() in Apache 2 sapi. (Ilia) - Fixed potential GLOBALS overwrite via import_request_variables() and possible crash and/or memory corruption. (Ilia) diff --git a/ext/curl/interface.c b/ext/curl/interface.c index 630a85a5e23..e7091d87d21 100644 --- a/ext/curl/interface.c +++ b/ext/curl/interface.c @@ -1146,10 +1146,15 @@ PHP_FUNCTION(curl_setopt) * must be explicitly cast to long in curl_formadd * use since curl needs a long not an int. */ if (*postval == '@') { + ++postval; + /* safe_mode / open_basedir check */ + if (php_check_open_basedir(postval TSRMLS_CC) || (PG(safe_mode) && !php_checkuid(postval, "rb+", CHECKUID_CHECK_MODE_PARAM))) { + RETURN_FALSE; + } error = curl_formadd(&first, &last, CURLFORM_COPYNAME, string_key, CURLFORM_NAMELENGTH, (long)string_key_len - 1, - CURLFORM_FILE, ++postval, + CURLFORM_FILE, postval, CURLFORM_END); } else { error = curl_formadd(&first, &last,