- Use CHECKUID_* #define's instead of cryptic numbers in php_checkuid()

- I did not test for validity of the actual php_checkuid() calls and there
- might be mistakes in the previous code.

diff --git a/ext/db/db.c b/ext/db/db.c
index 9f42cd8cfc513db84d1f8a7ebae9693e07a6d96b..5c5eb619667383664ba1cd9d4edf3505ce53c252 100644 (file)
--- a/ext/db/db.c
+++ b/ext/db/db.c
@@ -289,7 +289,7 @@ dbm_info *php_dbm_open(char *filename, char *mode) {
                return NULL;
        }
 
-       if (PG(safe_mode) && (!php_checkuid(filename, NULL, 2))) {
+       if (PG(safe_mode) && (!php_checkuid(filename, NULL, CHECKUID_CHECK_FILE_AND_DIR))) {
                return NULL;
        }
 

diff --git a/ext/dbase/dbase.c b/ext/dbase/dbase.c
index baa2520bd5f61e381a82ace2c8c73023891740c6..a6c5bf1557ef2d9b10f7c6f028eb510e7242f169 100644 (file)
--- a/ext/dbase/dbase.c
+++ b/ext/dbase/dbase.c
@@ -122,7 +122,7 @@ PHP_FUNCTION(dbase_open) {
        convert_to_string(dbf_name);
        convert_to_long(options);
 
-       if (PG(safe_mode) && (!php_checkuid(dbf_name->value.str.val, NULL, 2))) {
+       if (PG(safe_mode) && (!php_checkuid(dbf_name->value.str.val, NULL, CHECKUID_CHECK_FILE_AND_DIR))) {
                RETURN_FALSE;
        }
        
@@ -590,7 +590,7 @@ PHP_FUNCTION(dbase_create) {
                RETURN_FALSE;
        }
 
-       if (PG(safe_mode) && (!php_checkuid(Z_STRVAL_P(filename), NULL, 2))) {
+       if (PG(safe_mode) && (!php_checkuid(Z_STRVAL_P(filename), NULL, CHECKUID_CHECK_FILE_AND_DIR))) {
                RETURN_FALSE;
        }
        

diff --git a/ext/filepro/filepro.c b/ext/filepro/filepro.c
index c98cbabd77a343e6fdd50b08c2e43db05396e280..6b7a3b60618bddfdc3a727d3af0286d188318807 100644 (file)
--- a/ext/filepro/filepro.c
+++ b/ext/filepro/filepro.c
@@ -206,7 +206,7 @@ PHP_FUNCTION(filepro)
        
        sprintf(workbuf, "%s/map", dir->value.str.val);
 
-       if (PG(safe_mode) && (!php_checkuid(workbuf, NULL, 2))) {
+       if (PG(safe_mode) && (!php_checkuid(workbuf, NULL, CHECKUID_CHECK_FILE_AND_DIR))) {
                RETURN_FALSE;
        }
        
@@ -305,7 +305,7 @@ PHP_FUNCTION(filepro_rowcount)
        /* Now read the records in, moving forward recsize-1 bytes each time */
        sprintf(workbuf, "%s/key", FP_GLOBAL(fp_database));
 
-       if (PG(safe_mode) && (!php_checkuid(workbuf, NULL, 2))) {
+       if (PG(safe_mode) && (!php_checkuid(workbuf, NULL, CHECKUID_CHECK_FILE_AND_DIR))) {
                RETURN_FALSE;
        }
        
@@ -530,7 +530,7 @@ PHP_FUNCTION(filepro_retrieve)
        /* Now read the record in */
        sprintf(workbuf, "%s/key", FP_GLOBAL(fp_database));
 
-       if (PG(safe_mode) && (!php_checkuid(workbuf, NULL, 2))) {
+       if (PG(safe_mode) && (!php_checkuid(workbuf, NULL, CHECKUID_CHECK_FILE_AND_DIR))) {
                RETURN_FALSE;
        }
        

diff --git a/ext/pgsql/pgsql.c b/ext/pgsql/pgsql.c
index 1bbc9a86f2d6c225801bb12c0313847bf5280e34..68e53fedb10d85c7732d824c16754624083b579c 100644 (file)
--- a/ext/pgsql/pgsql.c
+++ b/ext/pgsql/pgsql.c
@@ -1663,7 +1663,7 @@ PHP_FUNCTION(pg_loimport)
                        break;
        }
        
-       if (PG(safe_mode) &&(!php_checkuid(Z_STRVAL_PP(file_in), NULL, 2))) {
+       if (PG(safe_mode) &&(!php_checkuid(Z_STRVAL_PP(file_in), NULL, CHECKUID_CHECK_FILE_AND_DIR))) {
                RETURN_FALSE;
        }
 

diff --git a/ext/posix/posix.c b/ext/posix/posix.c
index 0eba167dab94a84094301fe69b2ed6b60bbd5305..537ad4bf23a0100731b4d2bb5b9cfd0836fcf186 100644 (file)
--- a/ext/posix/posix.c
+++ b/ext/posix/posix.c
@@ -665,7 +665,7 @@ PHP_FUNCTION(posix_mkfifo)
        convert_to_string(path);
        convert_to_long(mode);
 
-       if (PG(safe_mode) && (!php_checkuid(path->value.str.val, NULL, 3))) {
+       if (PG(safe_mode) && (!php_checkuid(path->value.str.val, NULL, CHECKUID_ALLOW_ONLY_DIR))) {
                RETURN_FALSE;
        }
        result = mkfifo(path->value.str.val, mode->value.lval);

diff --git a/ext/standard/file.c b/ext/standard/file.c
index 02e4a7a94794b91374f47736524a21a6975ca741..fdee1c9f7c38ca37a2c7d30fd410deeeae32ef92 100644 (file)
--- a/ext/standard/file.c
+++ b/ext/standard/file.c
@@ -1287,7 +1287,7 @@ PHP_FUNCTION(mkdir)
        convert_to_string_ex(arg1);
        convert_to_long_ex(arg2);
        mode = (mode_t) (*arg2)->value.lval;
-       if (PG(safe_mode) &&(!php_checkuid((*arg1)->value.str.val, NULL, 3))) {
+       if (PG(safe_mode) &&(!php_checkuid((*arg1)->value.str.val, NULL, CHECKUID_ALLOW_ONLY_DIR))) {
                RETURN_FALSE;
        }
        ret = V_MKDIR((*arg1)->value.str.val, mode);
@@ -1312,7 +1312,7 @@ PHP_FUNCTION(rmdir)
                WRONG_PARAM_COUNT;
        }
        convert_to_string_ex(arg1);
-       if (PG(safe_mode) &&(!php_checkuid((*arg1)->value.str.val, NULL, 1))) {
+       if (PG(safe_mode) &&(!php_checkuid((*arg1)->value.str.val, NULL, CHECKUID_ALLOW_FILE_NOT_EXISTS))) {
                RETURN_FALSE;
        }
        ret = V_RMDIR((*arg1)->value.str.val);
@@ -1505,7 +1505,7 @@ PHP_FUNCTION(rename)
        old_name = (*old_arg)->value.str.val;
        new_name = (*new_arg)->value.str.val;
 
-       if (PG(safe_mode) &&(!php_checkuid(old_name, NULL, 2))) {
+       if (PG(safe_mode) &&(!php_checkuid(old_name, NULL, CHECKUID_CHECK_FILE_AND_DIR))) {
                RETURN_FALSE;
        }
        ret = V_RENAME(old_name, new_name);
@@ -1533,7 +1533,7 @@ PHP_FUNCTION(unlink)
        }
        convert_to_string_ex(filename);
 
-       if (PG(safe_mode) && !php_checkuid((*filename)->value.str.val, NULL, 2)) {
+       if (PG(safe_mode) && !php_checkuid((*filename)->value.str.val, NULL, CHECKUID_CHECK_FILE_AND_DIR)) {
                RETURN_FALSE;
        }
 
@@ -1639,7 +1639,7 @@ PHP_FUNCTION(copy)
        convert_to_string_ex(source);
        convert_to_string_ex(target);
 
-       if (PG(safe_mode) &&(!php_checkuid((*source)->value.str.val, NULL, 2))) {
+       if (PG(safe_mode) &&(!php_checkuid((*source)->value.str.val, NULL, CHECKUID_CHECK_FILE_AND_DIR))) {
                RETURN_FALSE;
        }
        

diff --git a/ext/standard/filestat.c b/ext/standard/filestat.c
index fa7099015457b1ce37d7fdc96c710468537016f7..e845f4872eec3f7842d71341eda32fbc8a8cd3f6 100644 (file)
--- a/ext/standard/filestat.c
+++ b/ext/standard/filestat.c
@@ -252,7 +252,7 @@ PHP_FUNCTION(chgrp)
                gid = (*group)->value.lval;
        }
 
-       if (PG(safe_mode) &&(!php_checkuid((*filename)->value.str.val, NULL, 1))) {
+       if (PG(safe_mode) &&(!php_checkuid((*filename)->value.str.val, NULL, CHECKUID_ALLOW_FILE_NOT_EXISTS))) {
                RETURN_FALSE;
        }
 
@@ -300,7 +300,7 @@ PHP_FUNCTION(chown)
                uid = (*user)->value.lval;
        }
 
-       if (PG(safe_mode) &&(!php_checkuid((*filename)->value.str.val, NULL, 1))) {
+       if (PG(safe_mode) &&(!php_checkuid((*filename)->value.str.val, NULL, CHECKUID_ALLOW_FILE_NOT_EXISTS))) {
                RETURN_FALSE;
        }
 
@@ -334,7 +334,7 @@ PHP_FUNCTION(chmod)
        convert_to_string_ex(filename);
        convert_to_long_ex(mode);
 
-       if (PG(safe_mode) &&(!php_checkuid((*filename)->value.str.val, NULL, 1))) {
+       if (PG(safe_mode) &&(!php_checkuid((*filename)->value.str.val, NULL, CHECKUID_ALLOW_FILE_NOT_EXISTS))) {
                RETURN_FALSE;
        }
 
@@ -397,7 +397,7 @@ PHP_FUNCTION(touch)
        }
        convert_to_string_ex(filename);
 
-       if (PG(safe_mode) &&(!php_checkuid((*filename)->value.str.val, NULL, 2))) {
+       if (PG(safe_mode) &&(!php_checkuid((*filename)->value.str.val, NULL, CHECKUID_CHECK_FILE_AND_DIR))) {
                if (newtime) efree(newtime);
                RETURN_FALSE;
        }

diff --git a/ext/standard/link.c b/ext/standard/link.c
index f7dd9a1aeb94eb5aad1878a97b0c1759d54cc38f..b5af9ca65d9ca2a2fbe0d2816233d5966aae5ca6 100644 (file)
--- a/ext/standard/link.c
+++ b/ext/standard/link.c
@@ -110,7 +110,7 @@ PHP_FUNCTION(symlink)
        convert_to_string_ex(topath);
        convert_to_string_ex(frompath);
 
-       if (PG(safe_mode) && !php_checkuid((*topath)->value.str.val, NULL, 2)) {
+       if (PG(safe_mode) && !php_checkuid((*topath)->value.str.val, NULL, CHECKUID_CHECK_FILE_AND_DIR)) {
                RETURN_FALSE;
        }
        if (!strncasecmp((*topath)->value.str.val,"http://",7) || !strncasecmp((*topath)->value.str.val,"ftp://",6)) {
@@ -141,7 +141,7 @@ PHP_FUNCTION(link)
        convert_to_string_ex(topath);
        convert_to_string_ex(frompath);
 
-       if (PG(safe_mode) && !php_checkuid((*topath)->value.str.val, NULL, 2)) {
+       if (PG(safe_mode) && !php_checkuid((*topath)->value.str.val, NULL, CHECKUID_CHECK_FILE_AND_DIR)) {
                RETURN_FALSE;
        }
        if (!strncasecmp((*topath)->value.str.val,"http://",7) || !strncasecmp((*topath)->value.str.val,"ftp://",6)) {

diff --git a/main/fopen_wrappers.c b/main/fopen_wrappers.c
index c0d6609ce505238fe13e9cd7257f99979bd81f89..032eac346bb39ee5466487e2ad41e2e343c32656 100644 (file)
--- a/main/fopen_wrappers.c
+++ b/main/fopen_wrappers.c
@@ -373,14 +373,14 @@ PHPAPI FILE *php_fopen_with_path(char *filename, char *mode, char *path, char **
 
        /* Absolute & relative path open */
        if ((*filename == '.') || (IS_ABSOLUTE_PATH(filename, filename_length))) {
-               if (PG(safe_mode) && (!php_checkuid(filename, mode, 0))) {
+               if (PG(safe_mode) && (!php_checkuid(filename, mode, CHECKUID_DISALLOW_FILE_NOT_EXISTS))) {
                        return NULL;
                }
                return php_fopen_and_set_opened_path(filename, mode, opened_path);
        }
 
        if (!path || (path && !*path)) {
-               if (PG(safe_mode) && (!php_checkuid(filename, mode, 0))) {
+               if (PG(safe_mode) && (!php_checkuid(filename, mode, CHECKUID_DISALLOW_FILE_NOT_EXISTS))) {
                        return NULL;
                }
                return php_fopen_and_set_opened_path(filename, mode, opened_path);
@@ -401,7 +401,7 @@ PHPAPI FILE *php_fopen_with_path(char *filename, char *mode, char *path, char **
                }
                snprintf(trypath, MAXPATHLEN, "%s/%s", ptr, filename);
                if (PG(safe_mode)) {
-                       if (V_STAT(trypath, &sb) == 0 && (!php_checkuid(trypath, mode, 0))) {
+                       if (V_STAT(trypath, &sb) == 0 && (!php_checkuid(trypath, mode, CHECKUID_DISALLOW_FILE_NOT_EXISTS))) {
                                efree(pathbuf);
                                return NULL;
                        }
@@ -464,7 +464,7 @@ static FILE *php_fopen_url_wrapper(const char *path, char *mode, int options, in
                if (options & USE_PATH) {
                        fp = php_fopen_with_path((char *) path, mode, PG(include_path), opened_path);
                } else {
-                       if (options & ENFORCE_SAFE_MODE && PG(safe_mode) && (!php_checkuid(path, mode, 0))) {
+                       if (options & ENFORCE_SAFE_MODE && PG(safe_mode) && (!php_checkuid(path, mode, CHECKUID_DISALLOW_FILE_NOT_EXISTS))) {
                                fp = NULL;
                        } else {
                                fp = php_fopen_and_set_opened_path(path, mode, opened_path);