From 1af5f8cd396c09f04ab1fff194c8f0698905a9f1 Mon Sep 17 00:00:00 2001 From: Ilia Alshanetsky Date: Wed, 27 Sep 2006 23:44:34 +0000 Subject: [PATCH] MFB: Fixed bug #38963 (Fixed a possible open_basedir bypass in tempnam()). --- main/php_open_temporary_file.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/main/php_open_temporary_file.c b/main/php_open_temporary_file.c index b2e27e2f79..60526fa0e4 100644 --- a/main/php_open_temporary_file.c +++ b/main/php_open_temporary_file.c @@ -206,6 +206,7 @@ PHPAPI const char* php_get_temporary_directory(void) PHPAPI int php_open_temporary_fd(const char *dir, const char *pfx, char **opened_path_p TSRMLS_DC) { int fd; + char *temp_dir = php_get_temporary_directory(); if (!pfx) { pfx = "tmp."; @@ -214,11 +215,19 @@ PHPAPI int php_open_temporary_fd(const char *dir, const char *pfx, char **opened *opened_path_p = NULL; } + if (!dir || *dir == '\0') { + if (temp_dir && *temp_dir != '\0' && !php_check_open_basedir(temp_dir TSRMLS_CC)) { + return php_do_open_temporary_file(temp_dir, pfx, opened_path_p TSRMLS_CC); + } else { + return -1; + } + } + /* Try the directory given as parameter. */ fd = php_do_open_temporary_file(dir, pfx, opened_path_p TSRMLS_CC); if (fd == -1) { /* Use default temporary directory. */ - fd = php_do_open_temporary_file(php_get_temporary_directory(), pfx, opened_path_p TSRMLS_CC); + fd = php_do_open_temporary_file(temp_dir, pfx, opened_path_p TSRMLS_CC); } return fd; } -- 2.50.1