From: Ilia Alshanetsky <iliaa@php.net>
Date: Wed, 27 Sep 2006 23:44:13 +0000 (+0000)
Subject: Fixed bug #38963 (Fixed a possible open_basedir bypass in tempnam()).
X-Git-Tag: php-5.2.0RC5~95
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=5860f471222a71e6283d23dbe4d736a27106e9a9;p=php

Fixed bug #38963 (Fixed a possible open_basedir bypass in tempnam()).
---

diff --git a/NEWS b/NEWS
index dc37153b44..9bb0d07074 100644
--- a/NEWS
+++ b/NEWS
@@ -8,6 +8,7 @@ PHP                                                                        NEWS
   (Dmitry)
 - Fixed bug #38961 (metaphone() results in segmentation fault on NetBSD). 
   (Tony)
+- Fixed bug #38963 (Fixed a possible open_basedir bypass in tempnam()). (Ilia)
 - Fixed bug #38949 (Cannot get xmlns value attribute). (Rob)
 - Fixed bug #38942 (Double old-style-ctor inheritance). (Dmitry)
 - Fixed bug #38941 (imap extension does not compile against new version of
diff --git a/main/php_open_temporary_file.c b/main/php_open_temporary_file.c
index b2e27e2f79..60526fa0e4 100644
--- a/main/php_open_temporary_file.c
+++ b/main/php_open_temporary_file.c
@@ -206,6 +206,7 @@ PHPAPI const char* php_get_temporary_directory(void)
 PHPAPI int php_open_temporary_fd(const char *dir, const char *pfx, char **opened_path_p TSRMLS_DC)
 {
 	int fd;
+	char *temp_dir = php_get_temporary_directory();
 
 	if (!pfx) {
 		pfx = "tmp.";
@@ -214,11 +215,19 @@ PHPAPI int php_open_temporary_fd(const char *dir, const char *pfx, char **opened
 		*opened_path_p = NULL;
 	}
 
+	if (!dir || *dir == '\0') {
+		if (temp_dir && *temp_dir != '\0' && !php_check_open_basedir(temp_dir TSRMLS_CC)) {
+			return php_do_open_temporary_file(temp_dir, pfx, opened_path_p TSRMLS_CC);
+		} else {
+			return -1;
+		}
+	}
+
 	/* Try the directory given as parameter. */
 	fd = php_do_open_temporary_file(dir, pfx, opened_path_p TSRMLS_CC);
 	if (fd == -1) {
 		/* Use default temporary directory. */
-		fd = php_do_open_temporary_file(php_get_temporary_directory(), pfx, opened_path_p TSRMLS_CC);
+		fd = php_do_open_temporary_file(temp_dir, pfx, opened_path_p TSRMLS_CC);
 	}
 	return fd;
 }