php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-04-20 06:21:12 +02:00
Code Issues Packages Projects Releases Wiki Activity

Make chmod in safe mode not allow SUID bits

Browse Source
This commit is contained in:
Stanislav Malyshev
2000-06-09 10:34:53 +00:00
parent 6ce07a85e4
commit 6cac26c21f
1 changed files with 10 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
ext/standard/filestat.c
View File

@@ -324,7 +324,7 @@ PHP_FUNCTION(chown)
PHP_FUNCTION(chmod)
{
pval **filename, **mode;
int ret;
int ret,imode;
PLS_FETCH();
if (ZEND_NUM_ARGS()!=2 || zend_get_parameters_ex(2,&filename,&mode)==FAILURE) {
@@ -341,7 +341,15 @@ PHP_FUNCTION(chmod)
if (php_check_open_basedir((*filename)->value.str.val))
RETURN_FALSE;
ret = chmod((*filename)->value.str.val, (*mode)->value.lval);
imode = (*mode)->value.lval;
/* in safe mode, do not allow to setuid files.
Setuiding files could allow users to gain privileges
that safe mode doesn't give them.
*/
if(PG(safe_mode))
imode &= 0777;
ret = chmod((*filename)->value.str.val, imode);
if (ret == -1) {
php_error(E_WARNING, "chmod failed: %s", strerror(errno));
RETURN_FALSE;