Fixed bug #29840 (is_executable() does not honor safe_mode_exec_dir

setting).

diff --git a/NEWS b/NEWS
index a58be71fbce60c8d9cea53fec728e154a4012e65..36771459c73d26aeaddf36a6db9d8a5d4907af7f 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -165,6 +165,8 @@ PHP                                                                        NEWS
 - Fixed bug #36644 (possible crash in variant_date_from_timestamp()). (Ilia)
 - Fixed bug #33282 (Re-assignment by reference does not clear the is_ref flag)
   (Ilia,Dmitry, Matt Wilmas)
+- Fixed bug #29840 (is_executable() does not honor safe_mode_exec_dir
+  setting). (Ilia)
 
 02 Nov 2006, PHP 5.2.0
 - Updated bundled OpenSSL to version 0.9.8d in the Windows distro. (Edin)

diff --git a/ext/standard/filestat.c b/ext/standard/filestat.c
index 5e98cc412ee309557832db9276df77c84332f583..0c113a3879f305a33d84ba311ff345c5c9434f92 100644 (file)
--- a/ext/standard/filestat.c
+++ b/ext/standard/filestat.c
@@ -684,14 +684,27 @@ PHPAPI void php_stat(const char *filename, php_stat_len filename_length, int typ
                              "size", "atime", "mtime", "ctime", "blksize", "blocks"};
        char *local;
        php_stream_wrapper *wrapper;
+       char safe_mode_buf[MAXPATHLEN];
 
        if (!filename_length) {
                RETURN_FALSE;
        }
 
        if ((wrapper = php_stream_locate_url_wrapper(filename, &local, 0 TSRMLS_CC)) == &php_plain_files_wrapper) {
-               if (php_check_open_basedir(local TSRMLS_CC) || (PG(safe_mode) && !php_checkuid_ex(filename, NULL, CHECKUID_ALLOW_FILE_NOT_EXISTS, CHECKUID_NO_ERRORS))) {
+               if (php_check_open_basedir(local TSRMLS_CC)) {
                        RETURN_FALSE;
+               } else if (PG(safe_mode)) {
+                       if (type == FS_IS_X) {
+                               if (strstr(local, "..")) {
+                                       RETURN_FALSE;
+                               } else {
+                                       char *b = strrchr(local, PHP_DIR_SEPARATOR);
+                                       snprintf(safe_mode_buf, MAXPATHLEN, "%s%s%s", PG(safe_mode_exec_dir), (b ? "" : "/"), (b ? b : local));
+                                       local = (char *)&safe_mode_buf;
+                               }
+                       } else if (!php_checkuid_ex(local, NULL, CHECKUID_ALLOW_FILE_NOT_EXISTS, CHECKUID_NO_ERRORS)) {
+                               RETURN_FALSE;
+                       }
                }
        }