Fixed bug #28632 (Prevent open_basedir bypass in MySQL's LOAD DATA LOCAL).

diff --git a/ext/mysql/php_mysql.c b/ext/mysql/php_mysql.c
index 093a2723ea2bc073bb21c970e7abc7b36bf3406e..11dae416329dfb862d19ab1ed2a2029781b97a50 100644 (file)
--- a/ext/mysql/php_mysql.c
+++ b/ext/mysql/php_mysql.c
@@ -598,6 +598,11 @@ static void php_mysql_do_connect(INTERNAL_FUNCTION_PARAMETERS, int persistent)
                                WRONG_PARAM_COUNT;
                                break;
                }
+               /* disable local infile option for open_basedir */
+                if (PG(open_basedir) && strlen(PG(open_basedir)) && (client_flags & CLIENT_LOCAL_FILES)) {
+                       client_flags ^= CLIENT_LOCAL_FILES;
+               }
+
                if (z_host) {
                        SEPARATE_ZVAL(z_host); /* We may modify z_host if it contains a port, separate */
                        convert_to_string_ex(z_host);