diff options
| author | Ilia Alshanetsky <iliaa@php.net> | 2003-06-19 22:18:58 +0000 |
|---|---|---|
| committer | Ilia Alshanetsky <iliaa@php.net> | 2003-06-19 22:18:58 +0000 |
| commit | 316d124ec46cf14621555a595fb8a0476790a689 (patch) | |
| tree | 4b6778e5350977b2603f20fc4bd3d0acb45bd30c | |
| parent | b1f59b47036893e5d53a12569cc2e2fb5de535b3 (diff) | |
| download | php-git-316d124ec46cf14621555a595fb8a0476790a689.tar.gz | |
Added missing safe_mode checks
| -rw-r--r-- | ext/curl/curl.c | 28 |
1 files changed, 23 insertions, 5 deletions
diff --git a/ext/curl/curl.c b/ext/curl/curl.c index ed12a6a3c5..a76057432c 100644 --- a/ext/curl/curl.c +++ b/ext/curl/curl.c @@ -729,20 +729,16 @@ PHP_FUNCTION(curl_setopt) case CURLOPT_USERAGENT: case CURLOPT_FTPPORT: case CURLOPT_COOKIE: - case CURLOPT_COOKIEFILE: case CURLOPT_REFERER: case CURLOPT_INTERFACE: case CURLOPT_KRB4LEVEL: - case CURLOPT_RANDOM_FILE: case CURLOPT_EGDSOCKET: case CURLOPT_CAINFO: case CURLOPT_CAPATH: - case CURLOPT_COOKIEJAR: case CURLOPT_SSL_CIPHER_LIST: case CURLOPT_SSLKEY: - case CURLOPT_SSLCERT: case CURLOPT_SSLKEYTYPE: - case CURLOPT_SSLKEYPASSWD: + case CURLOPT_SSLKEYPASSWD: case CURLOPT_SSLENGINE: #ifdef CURLOPT_ENCODING case CURLOPT_ENCODING: @@ -956,6 +952,28 @@ PHP_FUNCTION(curl_setopt) break; } + /* the following options deal with files, therefor safe_mode & open_basedir checks + * are required. + */ + case CURLOPT_COOKIEJAR: + case CURLOPT_SSLCERT: + case CURLOPT_RANDOM_FILE: + case CURLOPT_COOKIEFILE: { + char *copystr = NULL; + + convert_to_string_ex(zvalue); + + if (php_check_open_basedir(Z_STRVAL_PP(zvalue) TSRMLS_CC) || (PG(safe_mode) && !php_checkuid(Z_STRVAL_PP(zvalue), "rb+", CHECKUID_CHECK_MODE_PARAM))) { + RETURN_FALSE; + } + + copystr = estrndup(Z_STRVAL_PP(zvalue), Z_STRLEN_PP(zvalue)); + + error = curl_easy_setopt(ch->cp, option, copystr); + zend_llist_add_element(&ch->to_free.str, ©str); + + break; + } } SAVE_CURL_ERROR(ch, error); |