Re: [PHP-DEV] open_basedir bypass -> errata tempnam()

2011-09-28 Thread Nikita Popov
Hi Reindl! Do you realize that you are currently spamming hundreds of people that have subscribed this mailing list with pointless meta-discussions about how you think mailing list should work? The previous answer have already explained in detail why *all* mailing lists (this is not something spec

Re: [PHP-DEV] open_basedir bypass -> errata tempnam()

2011-09-28 Thread Reindl Harald
Am 28.09.2011 17:03, schrieb Ferenc Kovacs: >> please configure the mailing-list correct >> please add a hint that modern clients have a "reply-to-list" > > for the record, I don't have that in gmail. > >> please add a hint that the sender should be removed after >> reply-all because "internals

Re: [PHP-DEV] open_basedir bypass -> errata tempnam()

2011-09-28 Thread Rasmus Lerdorf
Reindl, please read http://www.unicom.com/pw/reply-to-harmful.html The list is configured correctly. On 09/28/2011 07:42 AM, Reindl Harald wrote: > > Am 28.09.2011 16:19, schrieb Hannes Magnusson: >> On Wed, Sep 28, 2011 at 00:39, Reindl Harald >> wrote: >>> PLEASE REPLY ONLY TO THE LIST >> >>

Re: [PHP-DEV] open_basedir bypass -> errata tempnam()

2011-09-28 Thread Ferenc Kovacs
> please configure the mailing-list correct > please add a hint that modern clients have a "reply-to-list" for the record, I don't have that in gmail. > please add a hint that the sender should be removed after > reply-all because "internals@lists.php.net" is reaching the > list AND the sender of

[PHP-DEV] Mailing list handling (was: Re: [PHP-DEV] open_basedir bypass -> errata tempnam())

2011-09-28 Thread Johannes Schlüter
On Wed, 2011-09-28 at 16:42 +0200, Reindl Harald wrote: > Am 28.09.2011 16:19, schrieb Hannes Magnusson: > > On Wed, Sep 28, 2011 at 00:39, Reindl Harald wrote: > >> PLEASE REPLY ONLY TO THE LIST > > > > PLEASE READ THE POSTING GUIDELINES BEFORE SCREAMING: > > http://se.php.net/mailing-lists.php

Re: [PHP-DEV] open_basedir bypass -> errata tempnam()

2011-09-28 Thread Reindl Harald
Am 28.09.2011 16:19, schrieb Hannes Magnusson: > On Wed, Sep 28, 2011 at 00:39, Reindl Harald wrote: >> PLEASE REPLY ONLY TO THE LIST > > PLEASE READ THE POSTING GUIDELINES BEFORE SCREAMING: > http://se.php.net/mailing-lists.php please configure the mailing-list correct please add a hint that m

Re: [PHP-DEV] open_basedir bypass -> errata tempnam()

2011-09-28 Thread Hannes Magnusson
On Wed, Sep 28, 2011 at 00:39, Reindl Harald wrote: > PLEASE REPLY ONLY TO THE LIST PLEASE READ THE POSTING GUIDELINES BEFORE SCREAMING: http://se.php.net/mailing-lists.php "Be sure to click Reply-All to reply to list. Clicking Reply will email the author of the message privately." -Hannes --

Re: [PHP-DEV] open_basedir bypass -> errata tempnam()

2011-09-28 Thread Reindl Harald
Am 28.09.2011 10:53, schrieb Pierre Joye: On Wed, Sep 28, 2011 at 10:50 AM, Reindl Harald wrote: > without any param /tmp is right but not as magical fallback and in > my opinion a well desigend webapp should never touch global /tmp > shared with other hosts and applications Well, a well conf

Re: [PHP-DEV] open_basedir bypass -> errata tempnam()

2011-09-28 Thread Pierre Joye
On Wed, Sep 28, 2011 at 10:50 AM, Reindl Harald wrote: > but it is wrong to create a file outside the open_basedir especially > if a full qualified directory was passed where it should be created Forgot to mention that this behavior is clearly documented: http://www.php.net/tempnam So it is no

Re: [PHP-DEV] open_basedir bypass -> errata tempnam()

2011-09-28 Thread Pierre Joye
On Wed, Sep 28, 2011 at 10:50 AM, Reindl Harald wrote: > without any param /tmp is right but not as magical fallback and in > my opinion a well desigend webapp should never touch global /tmp > shared with other hosts and applications Well, a well configured shared host has correct temporary dire

Re: [PHP-DEV] open_basedir bypass -> errata tempnam()

2011-09-28 Thread Reindl Harald
Am 28.09.2011 10:46, schrieb Pierre Joye: > hi, > > On Wed, Sep 28, 2011 at 9:02 AM, Reindl Harald wrote: > > First, all you need to test is: > > $tempfile = tempnam($temp_folder, 'rhcsv'); > $fp = fopen($tempfile , 'w'); > >> * /tmp MUST NOT be in open_basedir >> * the temp-folder must be r

Re: [PHP-DEV] open_basedir bypass -> errata tempnam()

2011-09-28 Thread Pierre Joye
hi, On Wed, Sep 28, 2011 at 9:02 AM, Reindl Harald wrote: First, all you need to test is: $tempfile = tempnam($temp_folder, 'rhcsv'); $fp = fopen($tempfile , 'w'); > * /tmp MUST NOT be in open_basedir > * the temp-folder must be read only > * QUESTION1: why is tempnam() falling back to a dir o

Re: [PHP-DEV] open_basedir bypass -> errata tempnam()

2011-09-28 Thread Reindl Harald
Am 28.09.2011 09:28, schrieb Pierre Joye: > On Wed, Sep 28, 2011 at 9:02 AM, Reindl Harald wrote: > >> $tmp_name = str_replace("\\", '/', tempnam($temp_folder, 'rhcsv')); > > Side note: this is never necessary, php does it for you. Unless you > store paths yourself before calling a php file f

Re: [PHP-DEV] open_basedir bypass -> errata tempnam()

2011-09-28 Thread Pierre Joye
On Wed, Sep 28, 2011 at 9:02 AM, Reindl Harald wrote: >  $tmp_name = str_replace("\\", '/', tempnam($temp_folder, 'rhcsv')); Side note: this is never necessary, php does it for you. Unless you store paths yourself before calling a php file function. -- Pierre @pierrejoye | http://blog.thepim

Re: [PHP-DEV] open_basedir bypass -> errata tempnam()

2011-09-28 Thread Reindl Harald
Am 28.09.2011 08:01, schrieb Antony Dovgal: > On 09/28/2011 02:39 AM, Reindl Harald wrote: >> PLEASE REPLY ONLY TO THE LIST > > Please provide a short (10 lines max) but complete reproduce script. > At the moment your explanations do not make any sense. what do you think was the content of my la

Re: [PHP-DEV] open_basedir bypass -> errata tempnam()

2011-09-27 Thread Antony Dovgal
On 09/28/2011 02:39 AM, Reindl Harald wrote: PLEASE REPLY ONLY TO THE LIST Please provide a short (10 lines max) but complete reproduce script. At the moment your explanations do not make any sense. -- Wbr, Antony Dovgal --- http://pinba.org - realtime profiling for PHP -- PHP Internals - PHP

Re: [PHP-DEV] open_basedir bypass -> errata tempnam()

2011-09-27 Thread Reindl Harald
Am 28.09.2011 00:34, schrieb Ángel González: > Reindl Harald schrieb: >> [root@arrakis:~]$ stat /tmp/rhcsvz8QeBL >> File: „/tmp/rhcsvz8QeBL“ >>> Are you sure it is the fopen() what is making it? >>> I think that some other function/extension may be creating the temporary >>> file >>> /tmp/rh

Re: [PHP-DEV] open_basedir bypass -> errata tempnam()

2011-09-27 Thread Ángel González
Reindl Harald schrieb: [root@arrakis:~]$ stat /tmp/rhcsvz8QeBL File: „/tmp/rhcsvz8QeBL“ Are you sure it is the fopen() what is making it? I think that some other function/extension may be creating the temporary file /tmp/rhcsvz8QeBL for you to open, which then fails due to the open_basedir.

Re: [PHP-DEV] open_basedir bypass -> errata tempnam()

2011-09-27 Thread Reindl Harald
Am 28.09.2011 00:16, schrieb Ángel González: > Reindl Harald wrote: >> below a correct open_basedir restriction >> >> but why can fopen() create this file outside the >> basedir and after that the restriction is active? >> >> this means in other words: fopen() can empty files outside the basedir

Re: [PHP-DEV] open_basedir bypass

2011-09-27 Thread Ángel González
Reindl Harald wrote: below a correct open_basedir restriction but why can fopen() create this file outside the basedir and after that the restriction is active? this means in other words: fopen() can empty files outside the basedir if their permissions are open enough Sep 27 10:53:26 open_base

[PHP-DEV] open_basedir bypass

2011-09-27 Thread Reindl Harald
below a correct open_basedir restriction but why can fopen() create this file outside the basedir and after that the restriction is active? this means in other words: fopen() can empty files outside the basedir if their permissions are open enough Sep 27 10:53:26 open_basedir restriction in effe