fd fix

diff --git a/NEWS b/NEWS
index 01481a304975642ef989e97a0ed3a70e53511807..6b63e90d4498d3dbd5d78f87026c325a79100477 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -40,6 +40,10 @@ PHP                                                                        NEWS
   . Fixed bug #54547 (wrong equality of string numbers). (Gustavo)
   . Fixed bug #54197 ([PATH=] sections incompatibility with user_ini.filename
     set to null). (Anatoliy)
+  . Changed php://fd to be available only for CLI.
+
+- Phar:
+  . Fix bug #61065 (Secunia SA44335). (Rasmus)
 
 - Reflection:
   . Implemented FR #61602 (Allow access to the name of constant

diff --git a/UPGRADING b/UPGRADING
index 391c3651ff3d0756a5bd4c725324eba77cb8282a..7177a6df64d2a1e6c5ea06c0a425067bf0c1b05e 100755 (executable)
--- a/UPGRADING
+++ b/UPGRADING
@@ -339,6 +339,8 @@ PHP 5.4 UPGRADE NOTES
 - ob_start() no longer starts multiple output buffers when passed
   array("callback1", "callback2", "callback3", ...).
 
+- Since 5.4.4, "php://fd" stream syntax is available only in CLI build.
+
 ==============================
 5. Changes to existing classes
 ==============================

diff --git a/ext/standard/php_fopen_wrapper.c b/ext/standard/php_fopen_wrapper.c
index a831dd1c161fa10c124ab1f8e2b93089f1f4a1a1..b51aaa219f23df08dd80d7683f40459003bad3e8 100644 (file)
--- a/ext/standard/php_fopen_wrapper.c
+++ b/ext/standard/php_fopen_wrapper.c
@@ -263,6 +263,20 @@ php_stream * php_stream_url_wrap_php(php_stream_wrapper *wrapper, char *path, ch
                long       fildes_ori;
                int                dtablesize;
 
+               if (strcmp(sapi_module.name, "cli")) {
+                       if (options & REPORT_ERRORS) {
+                               php_error_docref(NULL TSRMLS_CC, E_WARNING, "Direct access to file descriptors is only available from command-line PHP");
+                       }
+                       return NULL;
+               }
+
+               if ((options & STREAM_OPEN_FOR_INCLUDE) && !PG(allow_url_include) ) {
+                       if (options & REPORT_ERRORS) {
+                               php_error_docref(NULL TSRMLS_CC, E_WARNING, "URL file-access is disabled in the server configuration");
+                       }
+                       return NULL;
+               }
+
                start = &path[3];
                fildes_ori = strtol(start, &end, 10);
                if (end == start || *end != '\0') {