From: Johannes Schlüter <johannes@php.net>
Date: Thu, 11 Feb 2010 18:03:57 +0000 (+0000)
Subject: Merge 294882: Fixed safe_mode validation inside tempnam() when the directory
X-Git-Tag: php-5.3.2RC2~7
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=122d3583eebde1291b1295d4ed47bbc47ad41e7c;p=php

Merge 294882: Fixed safe_mode validation inside tempnam() when the directory
path does not end (iliaa)
---

diff --git a/NEWS b/NEWS
index 48b1a80510..fc0077d410 100644
--- a/NEWS
+++ b/NEWS
@@ -9,6 +9,8 @@ PHP                                                                        NEWS
   (Ilia)
 - Added stream_resolve_include_path(). (Mikko)
 
+- Fixed safe_mode validation inside tempnam() when the directory path does
+  not end with a /). (Martin Jansen)
 - Fixed a possible open_basedir/safe_mode bypass in session extension
   identified by Grzegorz Stachowiak. (Ilia)
 - Fixed possible crash when a error/warning is raised during php startup.
diff --git a/ext/standard/file.c b/ext/standard/file.c
index 10f2c7961a..704ef1231f 100644
--- a/ext/standard/file.c
+++ b/ext/standard/file.c
@@ -836,7 +836,7 @@ PHP_FUNCTION(tempnam)
 		return;
 	}
 
-	if (PG(safe_mode) &&(!php_checkuid(dir, NULL, CHECKUID_ALLOW_ONLY_DIR))) {
+	if (PG(safe_mode) &&(!php_checkuid(dir, NULL, CHECKUID_CHECK_FILE_AND_DIR))) {
 		RETURN_FALSE;
 	}