Re: PHP3 safe_mode and popen()

Subject: Re: PHP3 safe_mode and popen()
From: Thomas Köhler (jean-lucPICARD.FRANKEN.DE)
Date: Wed Jan 05 2000 - 02:50:18 CST

• Next message: Nick FitzGerald: "CuteFTP saved password 'encryption' weakness"
• Previous message: pedwardWEBCOM.COM: "Re: Symlinks and Cryogenic Sleep"
• In reply to: David TILLOY: "Re: PHP3 safe_mode and popen()"
• Next in thread: Kristian Koehntopp: "Re: PHP3 safe_mode and popen()"
• Reply: Thomas Köhler: "Re: PHP3 safe_mode and popen()"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

On Wed, Jan 05, 2000 at 04:27:48AM +0100,
David TILLOY <d.tilloyNNX.COM> wrote:
>
> Kristian Koehntopp [krisKOEHNTOPP.DE] a écrit:
> > PHP3 (http://www.php.net) is a scripting language used in many
> > webhosting setups. Often in hosting setups so called "safe_mode"
> > is enabled, which restricts the user in many ways. For example,
> > in safe_mode you are supposed to be able to execute only
> > programs from a safe_mode_exec_dir, if one is defined. Within
> > that directory there should be only a restricted command set
> > that is considered safe.
>
> [.../...]
>
> Right... Your patch seems to work only with php-3.0.12.
> I attach modified version for php-3.0.13.
>
> dav.

> --- /tmp/php-3.0.13/functions/file.c Sat Jan 1 05:31:15 2000
> +++ functions/file.c Tue Jan 4 23:35:16 2000
> -26,7 +26,7
> | Authors: Rasmus Lerdorf <rasmuslerdorf.on.ca> |
> +----------------------------------------------------------------------+
> */
> -/* $Id: file.c,v 1.229 2000/01/01 04:31:15 sas Exp $ */
> +/* $Id: file.c,v 1.230 2000/01/03 21:31:31 kk Exp $ */
> #include "php.h"
>
> #include <stdio.h>
> -51,6 +51,7
> #include "safe_mode.h"
> #include "php3_list.h"
> #include "php3_string.h"
> +#include "exec.h"
> #include "file.h"
> #if HAVE_PWD_H
> #if MSVC5
> -575,7 +576,7
> pval *arg1, *arg2;
> FILE *fp;
> int id;
> - char *p;
> + char *p, *tmp=NULL;
> char *b, buf[1024];
> TLS_VARS;
>
> -601,6 +602,11
> snprintf(buf,sizeof(buf),"%s/%s",php3_ini.safe_mode_exec_dir,arg1->value.str.val);
> }
> fp = popen(buf,p);

Not removing this line leaves the problem in PHP3. You'd better remove
it :-)

> +
> + tmp = _php3_escapeshellcmd(buf);
> + fp = popen(tmp,p);
> + efree(tmp); /* temporary copy, no longer necessary */
> +
> if (!fp) {
> php3_error(E_WARNING,"popen(\"%s\",\"%s\") - %s",buf,p,strerror(errno));
> RETURN_FALSE;

CU,
Thomas

-- 
 Thomas Köhler Email:   jean-lucpicard.franken.de   | LCARS - Linux for
     <><        WWW:  http://home.pages.de/~jeanluc/ | Computers on All
                IRC:             jeanluc             | Real Starships
   PGP public key: http://www.mayn.de/users/jean-luc/PGP-Public.asc

• Next message: Nick FitzGerald: "CuteFTP saved password 'encryption' weakness"
• Previous message: pedwardWEBCOM.COM: "Re: Symlinks and Cryogenic Sleep"
• In reply to: David TILLOY: "Re: PHP3 safe_mode and popen()"
• Next in thread: Kristian Koehntopp: "Re: PHP3 safe_mode and popen()"
• Reply: Thomas Köhler: "Re: PHP3 safe_mode and popen()"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b27 : Wed Jan 05 2000 - 11:27:16 CST