Fix bug #9526

diff --git a/ext/standard/file.c b/ext/standard/file.c
index a395ab29ceb6b1735187f68d8f35fbea6348687d..f86be131ebbd1ffa225df9aa05b19739d1b050b7 100644 (file)
--- a/ext/standard/file.c
+++ b/ext/standard/file.c
@@ -1894,10 +1894,18 @@ PHP_FUNCTION(copy)
                RETURN_FALSE;
        }
 
+       if (php_check_open_basedir((*source)->value.str.val)) {
+               RETURN_FALSE;
+       }
+
        if (PG(safe_mode) &&(!php_checkuid((*target)->value.str.val, NULL, CHECKUID_CHECK_FILE_AND_DIR))) {
                RETURN_FALSE;
        }
 
+       if (php_check_open_basedir((*target)->value.str.val)) {
+               RETURN_FALSE;
+       }
+
        if (php_copy_file(Z_STRVAL_PP(source), Z_STRVAL_PP(target))==SUCCESS) {
                RETURN_TRUE;
        } else {