Allow file uploads to bypass open_basedir checks (fixes regression)

diff --git a/main/php_open_temporary_file.c b/main/php_open_temporary_file.c
index c7f78ac7c2a18e41a58763e1caedc4d3fb6f7cb5..29b59e02fefac6d0f02f2743d9386276709d6a52 100644 (file)
--- a/main/php_open_temporary_file.c
+++ b/main/php_open_temporary_file.c
@@ -211,7 +211,7 @@ PHPAPI const char* php_get_temporary_directory(void)
  * This function should do its best to return a file pointer to a newly created
  * unique file, on every platform.
  */
-PHPAPI int php_open_temporary_fd(const char *dir, const char *pfx, char **opened_path_p TSRMLS_DC)
+PHPAPI int php_open_temporary_fd_ex(const char *dir, const char *pfx, char **opened_path_p, zend_bool open_basedir_check TSRMLS_DC)
 {
        int fd;
        const char *temp_dir;
@@ -227,7 +227,7 @@ PHPAPI int php_open_temporary_fd(const char *dir, const char *pfx, char **opened
 def_tmp:
                temp_dir = php_get_temporary_directory();
 
-               if (temp_dir && *temp_dir != '\0' && !php_check_open_basedir(temp_dir TSRMLS_CC)) {
+               if (temp_dir && *temp_dir != '\0' && (!open_basedir_check || !php_check_open_basedir(temp_dir TSRMLS_CC))) {
                        return php_do_open_temporary_file(temp_dir, pfx, opened_path_p TSRMLS_CC);
                } else {
                        return -1;
@@ -243,6 +243,11 @@ def_tmp:
        return fd;
 }
 
+PHPAPI int php_open_temporary_fd(const char *dir, const char *pfx, char **opened_path_p TSRMLS_DC)
+{
+       return php_open_temporary_fd_ex(dir, pfx, opened_path_p, 0 TSRMLS_CC);
+}
+
 PHPAPI FILE *php_open_temporary_file(const char *dir, const char *pfx, char **opened_path_p TSRMLS_DC)
 {
        FILE *fp;

diff --git a/main/php_open_temporary_file.h b/main/php_open_temporary_file.h
index 9565fcd6ca3d382d56177589b03ee52842705bae..9391d5fedb07076507a7f6cc6e05ca8d8a013335 100644 (file)
--- a/main/php_open_temporary_file.h
+++ b/main/php_open_temporary_file.h
@@ -23,6 +23,7 @@
 
 BEGIN_EXTERN_C()
 PHPAPI FILE *php_open_temporary_file(const char *dir, const char *pfx, char **opened_path_p TSRMLS_DC);
+PHPAPI int php_open_temporary_fd_ex(const char *dir, const char *pfx, char **opened_path_p, zend_bool open_basedir_check TSRMLS_DC);
 PHPAPI int php_open_temporary_fd(const char *dir, const char *pfx, char **opened_path_p TSRMLS_DC);
 PHPAPI const char *php_get_temporary_directory(void);
 PHPAPI void php_shutdown_temporary_directory();

diff --git a/main/rfc1867.c b/main/rfc1867.c
index db4c8644492470438a8c321de57a0637e53cf927..9a2beefc44c9fa44535652b27df044a72c62f7c5 100644 (file)
--- a/main/rfc1867.c
+++ b/main/rfc1867.c
@@ -1016,7 +1016,7 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_post_handler)
 
                        if (!skip_upload) {
                                /* Handle file */
-                               fd = php_open_temporary_fd(PG(upload_tmp_dir), "php", &temp_filename TSRMLS_CC);
+                               fd = php_open_temporary_fd_ex(PG(upload_tmp_dir), "php", &temp_filename, 1 TSRMLS_CC);
                                if (fd==-1) {
                                        sapi_module.sapi_error(E_WARNING, "File upload error - unable to create a temporary file");
                                        cancel_upload = UPLOAD_ERROR_E;