Added missing open_basedir & safe_mode checks to zip:// and bzip://

wrappers.

Issues idendtified by MOPB-20 and MOPB-21

diff --git a/ext/bz2/bz2.c b/ext/bz2/bz2.c
index ebe0eb5f37d4a54bcad1b0764fe0c45de055aab8..1f905e411e9182a4ded3d798f29d7e85dd15178e 100644 (file)
--- a/ext/bz2/bz2.c
+++ b/ext/bz2/bz2.c
@@ -225,6 +225,10 @@ PHP_BZ2_API php_stream *_php_stream_bz2open(php_stream_wrapper *wrapper,
 #else
        path_copy = path;
 #endif  
+
+       if ((PG(safe_mode) && (!php_checkuid(path_copy, NULL, CHECKUID_CHECK_FILE_AND_DIR))) || php_check_open_basedir(path_copy TSRMLS_CC)) {
+               return NULL;
+       }
        
        /* try and open it directly first */
        bz_file = BZ2_bzopen(path_copy, mode);
@@ -236,7 +240,7 @@ PHP_BZ2_API php_stream *_php_stream_bz2open(php_stream_wrapper *wrapper,
        
        if (bz_file == NULL) {
                /* that didn't work, so try and get something from the network/wrapper */
-               stream = php_stream_open_wrapper(path, mode, options | STREAM_WILL_CAST, opened_path);
+               stream = php_stream_open_wrapper(path, mode, options | STREAM_WILL_CAST | ENFORCE_SAFE_MODE, opened_path);
        
                if (stream) {
                        int fd;

diff --git a/ext/zip/zip_stream.c b/ext/zip/zip_stream.c
index c36df3e4c068ad9ca3c3ad26a08985f87c351dc7..d4b511cc09a0d99210c506cae9d78b31da81cd8a 100644 (file)
--- a/ext/zip/zip_stream.c
+++ b/ext/zip/zip_stream.c
@@ -112,6 +112,10 @@ php_stream *php_stream_zip_open(char *filename, char *path, char *mode STREAMS_D
        }
 
        if (filename) {
+               if ((PG(safe_mode) && (!php_checkuid(filename, NULL, CHECKUID_CHECK_FILE_AND_DIR))) || php_check_open_basedir(filename TSRMLS_CC)) {
+                       return NULL;
+               }
+
                /* duplicate to make the stream za independent (esp. for MSHUTDOWN) */
                stream_za = zip_open(filename, ZIP_CREATE, &err);
                if (!stream_za) {
@@ -189,6 +193,11 @@ php_stream *php_stream_zip_opener(php_stream_wrapper *wrapper,
        php_basename(path, path_len - fragment_len, NULL, 0, &file_basename, &file_basename_len TSRMLS_CC);
        fragment++;
 
+       if ((PG(safe_mode) && (!php_checkuid(file_dirname, NULL, CHECKUID_CHECK_FILE_AND_DIR))) || php_check_open_basedir(file_dirname TSRMLS_CC)) {
+               efree(file_basename);
+               return NULL;
+       }
+
        za = zip_open(file_dirname, ZIP_CREATE, &err);
        if (za) {
                zf = zip_fopen(za, fragment, 0);