From d2b4a581a508f7a16d8415ebf17135d93e18813e Mon Sep 17 00:00:00 2001 From: Ilia Alshanetsky Date: Wed, 14 Mar 2007 03:52:16 +0000 Subject: [PATCH] MFB: Added missing open_basedir & safe_mode checks to bzip:// wrapper. --- ext/bz2/bz2.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/ext/bz2/bz2.c b/ext/bz2/bz2.c index 1d40902115..a06b58fd2c 100644 --- a/ext/bz2/bz2.c +++ b/ext/bz2/bz2.c @@ -171,6 +171,10 @@ PHP_BZ2_API php_stream *_php_stream_bz2open(php_stream_wrapper *wrapper, #else path_copy = path; #endif + + if ((PG(safe_mode) && (!php_checkuid(path_copy, NULL, CHECKUID_CHECK_FILE_AND_DIR))) || php_check_open_basedir(path_copy TSRMLS_CC)) { + return NULL; + } /* try and open it directly first */ bz_file = BZ2_bzopen(path_copy, mode); @@ -182,7 +186,7 @@ PHP_BZ2_API php_stream *_php_stream_bz2open(php_stream_wrapper *wrapper, if (bz_file == NULL) { /* that didn't work, so try and get something from the network/wrapper */ - stream = php_stream_open_wrapper(path, mode, options | STREAM_WILL_CAST, opened_path); + stream = php_stream_open_wrapper(path, mode, options | STREAM_WILL_CAST | ENFORCE_SAFE_MODE, opened_path); if (stream) { int fd; -- 2.40.0