From: Ilia Alshanetsky <iliaa@php.net>
Date: Wed, 14 Mar 2007 03:50:18 +0000 (+0000)
Subject: Added missing open_basedir & safe_mode checks to zip:// and bzip://
X-Git-Tag: php-5.2.2RC1~160
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=6d70aa1f4e99d0ff8f9c334a9c0ce07a69cb26a3;p=php

Added missing open_basedir & safe_mode checks to zip:// and bzip://
wrappers.

Issues idendtified by MOPB-20 and MOPB-21
---

diff --git a/ext/bz2/bz2.c b/ext/bz2/bz2.c
index ebe0eb5f37..1f905e411e 100644
--- a/ext/bz2/bz2.c
+++ b/ext/bz2/bz2.c
@@ -225,6 +225,10 @@ PHP_BZ2_API php_stream *_php_stream_bz2open(php_stream_wrapper *wrapper,
 #else
 	path_copy = path;
 #endif  
+
+	if ((PG(safe_mode) && (!php_checkuid(path_copy, NULL, CHECKUID_CHECK_FILE_AND_DIR))) || php_check_open_basedir(path_copy TSRMLS_CC)) {
+		return NULL;
+	}
 	
 	/* try and open it directly first */
 	bz_file = BZ2_bzopen(path_copy, mode);
@@ -236,7 +240,7 @@ PHP_BZ2_API php_stream *_php_stream_bz2open(php_stream_wrapper *wrapper,
 	
 	if (bz_file == NULL) {
 		/* that didn't work, so try and get something from the network/wrapper */
-		stream = php_stream_open_wrapper(path, mode, options | STREAM_WILL_CAST, opened_path);
+		stream = php_stream_open_wrapper(path, mode, options | STREAM_WILL_CAST | ENFORCE_SAFE_MODE, opened_path);
 	
 		if (stream) {
 			int fd;
diff --git a/ext/zip/zip_stream.c b/ext/zip/zip_stream.c
index c36df3e4c0..d4b511cc09 100644
--- a/ext/zip/zip_stream.c
+++ b/ext/zip/zip_stream.c
@@ -112,6 +112,10 @@ php_stream *php_stream_zip_open(char *filename, char *path, char *mode STREAMS_D
 	}
 
 	if (filename) {
+		if ((PG(safe_mode) && (!php_checkuid(filename, NULL, CHECKUID_CHECK_FILE_AND_DIR))) || php_check_open_basedir(filename TSRMLS_CC)) {
+			return NULL;
+		}
+
 		/* duplicate to make the stream za independent (esp. for MSHUTDOWN) */
 		stream_za = zip_open(filename, ZIP_CREATE, &err);
 		if (!stream_za) {
@@ -189,6 +193,11 @@ php_stream *php_stream_zip_opener(php_stream_wrapper *wrapper,
 	php_basename(path, path_len - fragment_len, NULL, 0, &file_basename, &file_basename_len TSRMLS_CC);
 	fragment++;
 
+	if ((PG(safe_mode) && (!php_checkuid(file_dirname, NULL, CHECKUID_CHECK_FILE_AND_DIR))) || php_check_open_basedir(file_dirname TSRMLS_CC)) {
+		efree(file_basename);
+		return NULL;
+	}
+
 	za = zip_open(file_dirname, ZIP_CREATE, &err);
 	if (za) {
 		zf = zip_fopen(za, fragment, 0);