Bugzilla – Attachment 61661 Details for
Bug 136651
VUL-0: PHP mixes up open_basedir settings
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Requests
|
IDP Log In
|
Forgot Password
[patch]
please try with this patch.
php-4.4.0-fix-apache2handler.patch (text/plain), 4.70 KB, created by
Cristian RodrÃguez
on 2005-12-22 05:12:33 UTC
(
hide
)
Description:
please try with this patch.
Filename:
MIME Type:
Creator:
Cristian RodrÃguez
Created:
2005-12-22 05:12:33 UTC
Size:
4.70 KB
patch
obsolete
>Index: sapi/apache2handler/sapi_apache2.c >=================================================================== >RCS file: /repository/php-src/sapi/apache2handler/sapi_apache2.c,v >retrieving revision 1.1.2.40 >retrieving revision 1.1.2.40.2.9 >diff -u -a -r1.1.2.40 -r1.1.2.40.2.9 >--- sapi/apache2handler/sapi_apache2.c 8 Apr 2005 20:35:02 -0000 1.1.2.40 >+++ sapi/apache2handler/sapi_apache2.c 14 Dec 2005 03:38:55 -0000 1.1.2.40.2.9 >@@ -18,7 +18,7 @@ > +----------------------------------------------------------------------+ > */ > >-/* $Id: sapi_apache2.c,v 1.1.2.40 2005/04/08 20:35:02 sniper Exp $ */ >+/* $Id: sapi_apache2.c,v 1.1.2.40.2.9 2005/12/14 03:38:55 iliaa Exp $ */ > > #include <fcntl.h> > >@@ -443,6 +443,18 @@ > php_request_shutdown(NULL); > } > >+static void php_apache_ini_dtor(request_rec *r, request_rec *p TSRMLS_DC) >+{ >+ if (strcmp(r->protocol, "INCLUDED")) { >+ zend_try { zend_ini_deactivate(TSRMLS_C); } zend_end_try(); >+ } >+ if (p) { >+ ((php_struct *)SG(server_context))->r = p; >+ } else { >+ apr_pool_cleanup_run(r->pool, (void *)&SG(server_context), php_server_context_cleanup); >+ } >+} >+ > static int php_handler(request_rec *r) > { > php_struct *ctx; >@@ -453,15 +465,31 @@ > request_rec *parent_req = NULL; > TSRMLS_FETCH(); > >+#define PHPAP_INI_OFF php_apache_ini_dtor(r, parent_req TSRMLS_CC); >+ > conf = ap_get_module_config(r->per_dir_config, &php4_module); >+ >+ /* apply_config() needs r in some cases, so allocate server_context early */ >+ ctx = SG(server_context); >+ if (ctx == NULL || (ctx && ctx->request_processed && !strcmp(r->protocol, "INCLUDED"))) { >+ ctx = SG(server_context) = apr_pcalloc(r->pool, sizeof(*ctx)); >+ /* register a cleanup so we clear out the SG(server_context) >+ * after each request. Note: We pass in the pointer to the >+ * server_context in case this is handled by a different thread. >+ */ >+ apr_pool_cleanup_register(r->pool, (void *)&SG(server_context), php_server_context_cleanup, apr_pool_cleanup_null); >+ ctx->r = r; >+ ctx = NULL; /* May look weird to null it here, but it is to catch the right case in the first_try later on */ >+ } else { >+ parent_req = ctx->r; >+ ctx->r = r; >+ } > apply_config(conf); > > if (strcmp(r->handler, PHP_MAGIC_TYPE) && strcmp(r->handler, PHP_SOURCE_MAGIC_TYPE) && strcmp(r->handler, PHP_SCRIPT)) { > /* Check for xbithack in this case. */ > if (!AP2(xbithack) || strcmp(r->handler, "text/html") || !(r->finfo.protection & APR_UEXECUTE)) { >- zend_try { >- zend_ini_deactivate(TSRMLS_C); >- } zend_end_try(); >+ PHPAP_INI_OFF; > return DECLINED; > } > } >@@ -470,32 +498,24 @@ > * the configuration; default behaviour is to accept. */ > if (r->used_path_info == AP_REQ_REJECT_PATH_INFO > && r->path_info && r->path_info[0]) { >- zend_try { >- zend_ini_deactivate(TSRMLS_C); >- } zend_end_try(); >+ PHPAP_INI_OFF; > return HTTP_NOT_FOUND; > } > > /* handle situations where user turns the engine off */ > if (!AP2(engine)) { >- zend_try { >- zend_ini_deactivate(TSRMLS_C); >- } zend_end_try(); >+ PHPAP_INI_OFF; > return DECLINED; > } > > if (r->finfo.filetype == 0) { > php_apache_sapi_log_message_ex("script '%s' not found or unable to stat", r); >- zend_try { >- zend_ini_deactivate(TSRMLS_C); >- } zend_end_try(); >+ PHPAP_INI_OFF; > return HTTP_NOT_FOUND; > } > if (r->finfo.filetype == APR_DIR) { > php_apache_sapi_log_message_ex("attempt to invoke directory '%s' as script", r); >- zend_try { >- zend_ini_deactivate(TSRMLS_C); >- } zend_end_try(); >+ PHPAP_INI_OFF; > return HTTP_FORBIDDEN; > } > >@@ -511,24 +531,30 @@ > > zend_first_try { > >- ctx = SG(server_context); > if (ctx == NULL) { >- ctx = SG(server_context) = apr_pcalloc(r->pool, sizeof(*ctx)); >- /* register a cleanup so we clear out the SG(server_context) >- * after each request. Note: We pass in the pointer to the >- * server_context in case this is handled by a different thread. >- */ >- apr_pool_cleanup_register(r->pool, (void *)&SG(server_context), php_server_context_cleanup, apr_pool_cleanup_null); >- >- ctx->r = r; >+normal: > brigade = apr_brigade_create(r->pool, r->connection->bucket_alloc); >+ ctx = SG(server_context); > ctx->brigade = brigade; > > if (php_apache_request_ctor(r, ctx TSRMLS_CC)!=SUCCESS) { > zend_bailout(); > } > } else { >- parent_req = ctx->r; >+ if (!parent_req) { >+ parent_req = ctx->r; >+ } >+ if (parent_req && parent_req->handler && strcmp(parent_req->handler, PHP_MAGIC_TYPE) && strcmp(parent_req->handler, PHP_SOURCE_MAGIC_TYPE) && strcmp(parent_req->handler, PHP_SCRIPT)) { >+ if (php_apache_request_ctor(r, ctx TSRMLS_CC)!=SUCCESS) { >+ zend_bailout(); >+ } >+ } >+ >+ /* check if comming due to ErrorDocument */ >+ if (parent_req && parent_req->status != HTTP_OK) { >+ parent_req = NULL; >+ goto normal; >+ } > ctx->r = r; > brigade = ctx->brigade; > }
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
Actions:
View
|
Diff
Attachments on
bug 136651
: 61661