From 5f9d72c4311d2e35898b3d87b7ea62f4c899da05 Mon Sep 17 00:00:00 2001 From: Ilia Alshanetsky Date: Tue, 2 Nov 2004 00:37:32 +0000 Subject: [PATCH] Fixed open_basedir & safe_mode bypass inside readlink() function. --- ext/standard/link.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/ext/standard/link.c b/ext/standard/link.c index dca60529d9..ec67f19f51 100644 --- a/ext/standard/link.c +++ b/ext/standard/link.c @@ -65,6 +65,14 @@ PHP_FUNCTION(readlink) } convert_to_string_ex(filename); + if (PG(safe_mode) && !php_checkuid(Z_STRVAL_PP(filename), NULL, CHECKUID_CHECK_FILE_AND_DIR)) { + RETURN_FALSE; + } + + if (php_check_open_basedir(Z_STRVAL_PP(filename) TSRMLS_CC)) { + RETURN_FALSE; + } + ret = readlink(Z_STRVAL_PP(filename), buff, MAXPATHLEN-1); if (ret == -1) { -- 2.50.1