Fixed a bug that in many situations would cause open_basedir restriction to

be bypassed. Most notable exception, is the inclusion of files via include(),
with a partial path.

diff --git a/main/streams.c b/main/streams.c
index 0a3ad4ca5a11b3c702632e0be38ee981fb0dde1c..1a27c7c4db6ef8d66aff851edd6e17b53176780b 100755 (executable)
--- a/main/streams.c
+++ b/main/streams.c
@@ -1626,26 +1626,28 @@ PHPAPI php_stream *_php_stream_fopen_with_path(char *filename, char *mode, char
                        end++;
                }
                snprintf(trypath, MAXPATHLEN, "%s/%s", ptr, filename);
+               
+               if (php_check_open_basedir(trypath TSRMLS_CC)) {
+                       stream = NULL;
+                       goto stream_done;
+               }
+               
                if (PG(safe_mode)) {
                        if (VCWD_STAT(trypath, &sb) == 0) {
                                /* file exists ... check permission */
-
-                               if (php_check_open_basedir(trypath TSRMLS_CC)) {
-                                       stream = NULL;
-                               } else if ((php_check_safe_mode_include_dir(trypath TSRMLS_CC) == 0) ||
+                               if ((php_check_safe_mode_include_dir(trypath TSRMLS_CC) == 0) ||
                                                php_checkuid(trypath, mode, CHECKUID_CHECK_MODE_PARAM)) {
                                        /* UID ok, or trypath is in safe_mode_include_dir */
                                        stream = php_stream_fopen_rel(trypath, mode, opened_path, options);
                                } else {
                                        stream = NULL;
                                }
-
-                               efree(pathbuf);
-                               return stream;
+                               goto stream_done;
                        }
                }
                stream = php_stream_fopen_rel(trypath, mode, opened_path, options);
                if (stream) {
+                       stream_done:
                        efree(pathbuf);
                        return stream;
                }