Skip to content

Fix #65069: GlobIterator incorrect handling of open_basedir check - #9120

Closed
bukka wants to merge 1 commit into
php:masterfrom
bukka:glob_wrapper_open_basedir
Closed

Fix #65069: GlobIterator incorrect handling of open_basedir check#9120
bukka wants to merge 1 commit into
php:masterfrom
bukka:glob_wrapper_open_basedir

Conversation

@bukka

Copy link
Copy Markdown
Member

Proper checking and filtering of glob stream paths when open_basedir set.

This is a rebase with some minor changes of PR #398 that I did 9 years ago that got somehow sidetracked discussion about the correct glob behavior. After thinking about this, the PR still makes sense to me as it fixes the reported problem even though it doesn't do anything about the inconsistency which is however already present in glob so there is no reason to not apply this.

@bukka
bukkaforce-pushed the glob_wrapper_open_basedir branch 3 times, most recently from ec34cfa to d96c168CompareJuly 24, 2022 21:41
@bukka

Copy link
Copy Markdown
MemberAuthor

So after a bit of thinking I went for solution with empty array as it is really the only one that makes sense to me.

@bukka
bukkaforce-pushed the glob_wrapper_open_basedir branch from d96c168 to 960d127CompareJuly 25, 2022 10:47
@mvorisek

Copy link
Copy Markdown
Contributor

Will/can this PR address also https://3v4l.org/EYVGd?

@bukka
bukka changed the base branch from PHP-8.0 to masterJuly 25, 2022 16:55
@bukka
bukkaforce-pushed the glob_wrapper_open_basedir branch from 960d127 to f03676cCompareJuly 25, 2022 16:55
@bukka

Copy link
Copy Markdown
MemberAuthor

@mvorisek This PR is just for glob wrapper (glob://... or GlobIterator that uses that) so I don't think it can address the issue you mentioned. From a quick look, I'm not sure why this actually doesn't work as it is under /in but haven't checked the code. Even if it is supposed to be like that, it might be worth to create a separate issue for it because it might be at least a documentation issue. Can you check if there is already a bug for this by any chance?

@mvorisek

Copy link
Copy Markdown
Contributor

Can you check if there is already a bug for this by any chance?

https://bugs.php.net/bug.php?id=52065

@bukka
bukkaforce-pushed the glob_wrapper_open_basedir branch from f03676c to 7953a39CompareJuly 25, 2022 19:15

@GirgiasGirgias left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The removal of the warning is IMHO good, can't really comment on the implementation as I'm far from being familiar of the stream layer

Comment threadext/spl/tests/bug65069.phpt Outdated
Comment threadext/spl/tests/bug65069.phpt Outdated
Comment threadext/spl/tests/bug65069.phpt Outdated
@bukka
bukkaforce-pushed the glob_wrapper_open_basedir branch from 7953a39 to 76eb3baCompareJuly 26, 2022 12:25
@bukka

Copy link
Copy Markdown
MemberAuthor

@cmb69 I saw your comments in the related PR https://bugs.php.net/bug.php?id=77085 so it would be great if you could have a quick look. I target master as there is that potential minor BC break that you mentioned in that bug for glob function. I would actually like to introduce the same behavior for glob as it just doesn't make sense to do open basedir check on pattern. I think it should be still fine for beta. What do you think?

@cmb69cmb69 left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This looks generally good to me. I made some suggestions for your consideration.

Comment threadext/spl/tests/bug65069.phpt Outdated
Comment threadmain/streams/glob_wrapper.c Outdated
Comment threadmain/streams/glob_wrapper.c Outdated
@bukka
bukkaforce-pushed the glob_wrapper_open_basedir branch from 76eb3ba to 3235c92CompareJuly 26, 2022 17:22
@bukka

Copy link
Copy Markdown
MemberAuthor

Merged via 1a9e689

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants

@bukka@mvorisek@cmb69@Girgias