MFB: Fixed bug #38934 (move_uploaded_file() cannot read uploaded file

outside of open_basedir).

diff --git a/ext/standard/basic_functions.c b/ext/standard/basic_functions.c
index 066a75648bf9ec1dc4f72913e2d96ec7f77c0268..5e28c1b46229d439404cafd11bfd4a77f7dc140f 100644 (file)
--- a/ext/standard/basic_functions.c
+++ b/ext/standard/basic_functions.c
@@ -6024,8 +6024,7 @@ PHP_FUNCTION(move_uploaded_file)
        VCWD_UNLINK(Z_STRVAL_PP(new_path));
        if (rename(Z_STRVAL_PP(path), Z_STRVAL_PP(new_path)) == 0) {
                successful = 1;
-       } else
-               if (php_copy_file(Z_STRVAL_PP(path), Z_STRVAL_PP(new_path) TSRMLS_CC) == SUCCESS) {
+       } else if (php_copy_file_ex(Z_STRVAL_PP(path), Z_STRVAL_PP(new_path), STREAM_DISABLE_OPEN_BASEDIR TSRMLS_CC) == SUCCESS) {
                VCWD_UNLINK(Z_STRVAL_PP(path));
                successful = 1;
        }

diff --git a/ext/standard/file.c b/ext/standard/file.c
index 21e2393c45a4bd7fc8ad9453c1aff58d8342ddaf..6f9ca62b734fd8a4d9ff6e29a2d92914f5bcd0e0 100644 (file)
--- a/ext/standard/file.c
+++ b/ext/standard/file.c
@@ -1799,9 +1799,14 @@ PHP_FUNCTION(copy)
 }
 /* }}} */
 
+PHPAPI int php_copy_file(char *src, char *dest TSRMLS_DC)
+{
+       return php_copy_file_ex(src, dest, 0 TSRMLS_CC);
+}
+
 /* {{{ php_copy_file
  */
-PHPAPI int php_copy_file(char *src, char *dest TSRMLS_DC)
+PHPAPI int php_copy_file_ex(char *src, char *dest, int src_chk TSRMLS_DC)
 {
        php_stream *srcstream = NULL, *deststream = NULL;
        int ret = FAILURE;
@@ -1856,7 +1861,7 @@ no_stat:
        }
 safe_to_copy:
 
-       srcstream = php_stream_open_wrapper(src, "rb", REPORT_ERRORS, NULL);
+       srcstream = php_stream_open_wrapper(src, "rb", src_chk | REPORT_ERRORS, NULL);
        
        if (!srcstream) {
                return ret;