Fixed safe_mode validation inside tempnam() when the directory path does not end...

diff --git a/NEWS b/NEWS
index 63ae97d2726fa170544d0320f02f2e3c6af64c88..f82d1f19f76cfb949d5fae32a6216f22f9d620eb 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -15,6 +15,8 @@ PHP                                                                        NEWS
 - Added stream filter support to mcrypt extension (ported from 
   mcrypt_filter). (Stas)
 
+- Fixed safe_mode validation inside tempnam() when the directory path does
+  not end with a /). (Martin Jansen)
 - Fixed a possible open_basedir/safe_mode bypass in session extension
   identified by Grzegorz Stachowiak. (Ilia)
 - Fixed possible crash when a error/warning is raised during php startup.

diff --git a/ext/standard/file.c b/ext/standard/file.c
index 10f2c7961aad700714a09444b5a7938f275d78fb..704ef1231fb7e7e16f48012a6e2dab3383c8386a 100644 (file)
--- a/ext/standard/file.c
+++ b/ext/standard/file.c
@@ -836,7 +836,7 @@ PHP_FUNCTION(tempnam)
                return;
        }
 
-       if (PG(safe_mode) &&(!php_checkuid(dir, NULL, CHECKUID_ALLOW_ONLY_DIR))) {
+       if (PG(safe_mode) &&(!php_checkuid(dir, NULL, CHECKUID_CHECK_FILE_AND_DIR))) {
                RETURN_FALSE;
        }