From: Ilia Alshanetsky <iliaa@php.net>
Date: Thu, 15 Nov 2007 18:58:43 +0000 (+0000)
Subject: MFB: Fixed bug #43276 (Incomplete fix for bug #42739, mkdir() under
X-Git-Tag: php-5.2.6RC1~307
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=81676a4b6e393608453a71e58760d25770b22383;p=php

MFB: Fixed bug #43276 (Incomplete fix for bug #42739, mkdir() under
safe_mode).
---

diff --git a/NEWS b/NEWS
index cfccaeef36..142edb032b 100644
--- a/NEWS
+++ b/NEWS
@@ -4,6 +4,8 @@ PHP                                                                        NEWS
 - Fixed bug #43293 (Multiple segfaults in getopt()). (Hannes)
 - Fixed bug #43279 (pg_send_query_params() converts all elements in 'params' 
   to strings). (Ilia)
+- Fixed bug #43276 (Incomplete fix for bug #42739, mkdir() under safe_mode).
+  (Ilia)
 - Fixed bug #43248 (backward compatibility break in realpath()). (Dmitry)
 - Fixed bug #43221 (SimpleXML adding default namespace in addAttribute). (Rob)
 - Fixed bug #43216 (stream_is_local() returns false on "file://"). (Dmitry)
diff --git a/main/safe_mode.c b/main/safe_mode.c
index 97c7613dde..e14ba189f9 100644
--- a/main/safe_mode.c
+++ b/main/safe_mode.c
@@ -122,10 +122,17 @@ PHPAPI int php_checkuid_ex(const char *filename, const char *fopen_mode, int mod
 
 		/* Trim off filename */
 		if ((s = strrchr(path, DEFAULT_SLASH))) {
-			if (s == path)
-				path[1] = '\0';
-			else
+			if (*(s + 1) == '\0' && s != path) { /* make sure that the / is not the last character */
 				*s = '\0';
+				s = strrchr(path, DEFAULT_SLASH);
+			}
+			if (s) {
+				if (s == path) {
+					path[1] = '\0';
+				} else {
+					*s = '\0';
+				}
+			}
 		}
 	} else { /* CHECKUID_ALLOW_ONLY_DIR */
 		s = strrchr(filename, DEFAULT_SLASH);