From 9230cf3da61f904564df9d9dffaa4422950e2943 Mon Sep 17 00:00:00 2001 From: Ilia Alshanetsky Date: Wed, 4 Oct 2006 23:19:25 +0000 Subject: [PATCH] Fixed missing open_basedir check inside chdir() function. --- NEWS | 1 + ext/standard/dir.c | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/NEWS b/NEWS index ad8a1bfa9d..6410fdc750 100644 --- a/NEWS +++ b/NEWS @@ -7,6 +7,7 @@ PHP NEWS - Fixed mess with CGI/CLI -d option (now it works with cgi; constants are working exactly like in php.ini; with FastCGI -d affects all requests). (Dmitry) +- Fixed missing open_basedir check inside chdir() function. (Ilia) - Fixed bug #39035 (Compatibilty issue between DOM and zend.ze1_compatibility_mode). (Rob) - Fixed bug #39032 (strcspn() stops on null character). (Tony) diff --git a/ext/standard/dir.c b/ext/standard/dir.c index baa9a79c32..db70ba9afb 100644 --- a/ext/standard/dir.c +++ b/ext/standard/dir.c @@ -286,7 +286,7 @@ PHP_FUNCTION(chdir) RETURN_FALSE; } - if (PG(safe_mode) && !php_checkuid(str, NULL, CHECKUID_CHECK_FILE_AND_DIR)) { + if ((PG(safe_mode) && !php_checkuid(str, NULL, CHECKUID_CHECK_FILE_AND_DIR)) || php_check_open_basedir(str TSRMLS_CC)) { RETURN_FALSE; } ret = VCWD_CHDIR(str); -- 2.40.0