mirror of
https://github.com/phpbb/phpbb.git
synced 2025-06-12 06:18:52 +00:00
remove one problematic instance from the realpath replacement
git-svn-id: file:///svn/phpbb/trunk@8129 89ea8834-ac86-4346-8a33-228a782c2dd0
This commit is contained in:
Meik Sievertsen
parent
eca02ecbf3
commit
303239afa4
1 changed files with 167 additions and 177 deletions
|
|
@ -8,6 +8,14 @@
|
||||||
*
|
*
|
||||||
*/
|
*/
|
||||||
|
|
||||||
|
/**
|
||||||
|
* @ignore
|
||||||
|
*/
|
||||||
|
if (!defined('IN_PHPBB'))
|
||||||
|
{
|
||||||
|
exit;
|
||||||
|
}
|
||||||
|
|
||||||
// Common global functions
|
// Common global functions
|
||||||
|
|
||||||
/**
|
/**
|
||||||
|
|
@ -472,184 +480,166 @@ if (!function_exists('stripos'))
|
||||||
|
|
||||||
if (!function_exists('realpath'))
|
if (!function_exists('realpath'))
|
||||||
{
|
{
|
||||||
if (DIRECTORY_SEPARATOR != '\\' && !(bool) ini_get('safe_mode') && function_exists('shell_exec') && trim(`realpath .`))
|
/**
|
||||||
|
* Checks if a path ($path) is absolute or relative
|
||||||
|
*
|
||||||
|
* @param string $path Path to check absoluteness of
|
||||||
|
* @return boolean
|
||||||
|
*/
|
||||||
|
function is_absolute($path)
|
||||||
{
|
{
|
||||||
/**
|
return ($path[0] == '/' || (DIRECTORY_SEPARATOR == '\\' && preg_match('#^[a-z]:/#i', $path))) ? true : false;
|
||||||
* @author Chris Smith <chris@project-minerva.org>
|
|
||||||
* @copyright 2006 Project Minerva Team
|
|
||||||
* @param string $path The path which we should attempt to resolve.
|
|
||||||
* @return mixed
|
|
||||||
* @ignore
|
|
||||||
*/
|
|
||||||
function phpbb_realpath($path)
|
|
||||||
{
|
|
||||||
$arg = escapeshellarg($path);
|
|
||||||
return trim(`realpath '$arg'`);
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
else
|
|
||||||
|
/**
|
||||||
|
* @author Chris Smith <chris@project-minerva.org>
|
||||||
|
* @copyright 2006 Project Minerva Team
|
||||||
|
* @param string $path The path which we should attempt to resolve.
|
||||||
|
* @return mixed
|
||||||
|
*/
|
||||||
|
function phpbb_realpath($path)
|
||||||
{
|
{
|
||||||
/**
|
// Now to perform funky shizzle
|
||||||
* Checks if a path ($path) is absolute or relative
|
|
||||||
*
|
// Switch to use UNIX slashes
|
||||||
* @param string $path Path to check absoluteness of
|
$path = str_replace(DIRECTORY_SEPARATOR, '/', $path);
|
||||||
* @return boolean
|
$path_prefix = '';
|
||||||
*/
|
|
||||||
function is_absolute($path)
|
// Determine what sort of path we have
|
||||||
|
if (is_absolute($path))
|
||||||
{
|
{
|
||||||
return ($path[0] == '/' || (DIRECTORY_SEPARATOR == '\\' && preg_match('#^[a-z]:/#i', $path))) ? true : false;
|
$absolute = true;
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
if ($path[0] == '/')
|
||||||
* @author Chris Smith <chris@project-minerva.org>
|
|
||||||
* @copyright 2006 Project Minerva Team
|
|
||||||
* @param string $path The path which we should attempt to resolve.
|
|
||||||
* @return mixed
|
|
||||||
*/
|
|
||||||
function phpbb_realpath($path)
|
|
||||||
{
|
|
||||||
// Now to perform funky shizzle
|
|
||||||
|
|
||||||
// Switch to use UNIX slashes
|
|
||||||
$path = str_replace(DIRECTORY_SEPARATOR, '/', $path);
|
|
||||||
$path_prefix = '';
|
|
||||||
|
|
||||||
// Determine what sort of path we have
|
|
||||||
if (is_absolute($path))
|
|
||||||
{
|
{
|
||||||
|
// Absolute path, *NIX style
|
||||||
|
$path_prefix = '';
|
||||||
|
}
|
||||||
|
else
|
||||||
|
{
|
||||||
|
// Absolute path, Windows style
|
||||||
|
// Remove the drive letter and colon
|
||||||
|
$path_prefix = $path[0] . ':';
|
||||||
|
$path = substr($path, 2);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
else
|
||||||
|
{
|
||||||
|
// Relative Path
|
||||||
|
// Prepend the current working directory
|
||||||
|
if (function_exists('getcwd'))
|
||||||
|
{
|
||||||
|
// This is the best method, hopefully it is enabled!
|
||||||
|
$path = str_replace(DIRECTORY_SEPARATOR, '/', getcwd()) . '/' . $path;
|
||||||
$absolute = true;
|
$absolute = true;
|
||||||
|
if (preg_match('#^[a-z]:#i', $path))
|
||||||
if ($path[0] == '/')
|
|
||||||
{
|
{
|
||||||
// Absolute path, *NIX style
|
$path_prefix = $path[0] . ':';
|
||||||
$path_prefix = '';
|
$path = substr($path, 2);
|
||||||
}
|
}
|
||||||
else
|
else
|
||||||
{
|
{
|
||||||
// Absolute path, Windows style
|
$path_prefix = '';
|
||||||
// Remove the drive letter and colon
|
}
|
||||||
$path_prefix = $path[0] . ':';
|
}
|
||||||
$path = substr($path, 2);
|
else if (isset($_SERVER['SCRIPT_FILENAME']) && !empty($_SERVER['SCRIPT_FILENAME']))
|
||||||
|
{
|
||||||
|
// Warning: If chdir() has been used this will lie!
|
||||||
|
// Warning: This has some problems sometime (CLI can create them easily)
|
||||||
|
$path = str_replace(DIRECTORY_SEPARATOR, '/', dirname($_SERVER['SCRIPT_FILENAME'])) . '/' . $path;
|
||||||
|
$absolute = true;
|
||||||
|
$path_prefix = '';
|
||||||
|
}
|
||||||
|
else
|
||||||
|
{
|
||||||
|
// We have no way of getting the absolute path, just run on using relative ones.
|
||||||
|
$absolute = false;
|
||||||
|
$path_prefix = '.';
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// Remove any repeated slashes
|
||||||
|
$path = preg_replace('#/{2,}#', '/', $path);
|
||||||
|
|
||||||
|
// Remove the slashes from the start and end of the path
|
||||||
|
$path = trim($path, '/');
|
||||||
|
|
||||||
|
// Break the string into little bits for us to nibble on
|
||||||
|
$bits = explode('/', $path);
|
||||||
|
|
||||||
|
// Remove any . in the path, renumber array for the loop below
|
||||||
|
$bits = array_values(array_diff($bits, array('.')));
|
||||||
|
|
||||||
|
// Lets get looping, run over and resolve any .. (up directory)
|
||||||
|
for ($i = 0, $max = sizeof($bits); $i < $max; $i++)
|
||||||
|
{
|
||||||
|
// @todo Optimise
|
||||||
|
if ($bits[$i] == '..' )
|
||||||
|
{
|
||||||
|
if (isset($bits[$i - 1]))
|
||||||
|
{
|
||||||
|
if ($bits[$i - 1] != '..')
|
||||||
|
{
|
||||||
|
// We found a .. and we are able to traverse upwards, lets do it!
|
||||||
|
unset($bits[$i]);
|
||||||
|
unset($bits[$i - 1]);
|
||||||
|
$i -= 2;
|
||||||
|
$max -= 2;
|
||||||
|
$bits = array_values($bits);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
else if ($absolute) // ie. !isset($bits[$i - 1]) && $absolute
|
||||||
|
{
|
||||||
|
// We have an absolute path trying to descend above the root of the filesystem
|
||||||
|
// ... Error!
|
||||||
|
return false;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// Prepend the path prefix
|
||||||
|
array_unshift($bits, $path_prefix);
|
||||||
|
|
||||||
|
$resolved = '';
|
||||||
|
|
||||||
|
$max = sizeof($bits) - 1;
|
||||||
|
|
||||||
|
// Check if we are able to resolve symlinks, Windows cannot.
|
||||||
|
$symlink_resolve = (function_exists('readlink')) ? true : false;
|
||||||
|
|
||||||
|
foreach ($bits as $i => $bit)
|
||||||
|
{
|
||||||
|
if (@is_dir("$resolved/$bit") || ($i == $max && @is_file("$resolved/$bit")))
|
||||||
|
{
|
||||||
|
// Path Exists
|
||||||
|
if ($symlink_resolve && is_link("$resolved/$bit") && ($link = readlink("$resolved/$bit")))
|
||||||
|
{
|
||||||
|
// Resolved a symlink.
|
||||||
|
$resolved = $link . (($i == $max) ? '' : '/');
|
||||||
|
continue;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
else
|
else
|
||||||
{
|
{
|
||||||
// Relative Path
|
// Something doesn't exist here!
|
||||||
// Prepend the current working directory
|
// This is correct realpath() behaviour but sadly open_basedir and safe_mode make this problematic
|
||||||
if (function_exists('getcwd'))
|
// return false;
|
||||||
{
|
|
||||||
// This is the best method, hopefully it is enabled!
|
|
||||||
$path = str_replace(DIRECTORY_SEPARATOR, '/', getcwd()) . '/' . $path;
|
|
||||||
$absolute = true;
|
|
||||||
if (preg_match('#^[a-z]:#i', $path))
|
|
||||||
{
|
|
||||||
$path_prefix = $path[0] . ':';
|
|
||||||
$path = substr($path, 2);
|
|
||||||
}
|
|
||||||
else
|
|
||||||
{
|
|
||||||
$path_prefix = '';
|
|
||||||
}
|
|
||||||
}
|
|
||||||
else if (isset($_SERVER['SCRIPT_FILENAME']) && !empty($_SERVER['SCRIPT_FILENAME']))
|
|
||||||
{
|
|
||||||
// Warning: If chdir() has been used this will lie!
|
|
||||||
// Warning: This has some problems sometime (CLI can create them easily)
|
|
||||||
$path = str_replace(DIRECTORY_SEPARATOR, '/', dirname($_SERVER['SCRIPT_FILENAME'])) . '/' . $path;
|
|
||||||
$absolute = true;
|
|
||||||
$path_prefix = '';
|
|
||||||
}
|
|
||||||
else
|
|
||||||
{
|
|
||||||
// We have no way of getting the absolute path, just run on using relative ones.
|
|
||||||
$absolute = false;
|
|
||||||
$path_prefix = '.';
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
|
$resolved .= $bit . (($i == $max) ? '' : '/');
|
||||||
// Remove any repeated slashes
|
|
||||||
$path = preg_replace('#/{2,}#', '/', $path);
|
|
||||||
|
|
||||||
// Remove the slashes from the start and end of the path
|
|
||||||
$path = trim($path, '/');
|
|
||||||
|
|
||||||
// Break the string into little bits for us to nibble on
|
|
||||||
$bits = explode('/', $path);
|
|
||||||
|
|
||||||
// Remove any . in the path, renumber array for the loop below
|
|
||||||
$bits = array_values(array_diff($bits, array('.')));
|
|
||||||
|
|
||||||
// Lets get looping, run over and resolve any .. (up directory)
|
|
||||||
for ($i = 0, $max = sizeof($bits); $i < $max; $i++)
|
|
||||||
{
|
|
||||||
// @todo Optimise
|
|
||||||
if ($bits[$i] == '..' )
|
|
||||||
{
|
|
||||||
if (isset($bits[$i - 1]))
|
|
||||||
{
|
|
||||||
if ($bits[$i - 1] != '..')
|
|
||||||
{
|
|
||||||
// We found a .. and we are able to traverse upwards, lets do it!
|
|
||||||
unset($bits[$i]);
|
|
||||||
unset($bits[$i - 1]);
|
|
||||||
$i -= 2;
|
|
||||||
$max -= 2;
|
|
||||||
$bits = array_values($bits);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
else if ($absolute) // ie. !isset($bits[$i - 1]) && $absolute
|
|
||||||
{
|
|
||||||
// We have an absolute path trying to descend above the root of the filesystem
|
|
||||||
// ... Error!
|
|
||||||
return false;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// Prepend the path prefix
|
|
||||||
array_unshift($bits, $path_prefix);
|
|
||||||
|
|
||||||
$resolved = '';
|
|
||||||
|
|
||||||
$max = sizeof($bits) - 1;
|
|
||||||
|
|
||||||
// Check if we are able to resolve symlinks, Windows cannot.
|
|
||||||
$symlink_resolve = (function_exists('readlink')) ? true : false;
|
|
||||||
|
|
||||||
foreach ($bits as $i => $bit)
|
|
||||||
{
|
|
||||||
if (@is_dir("$resolved/$bit") || ($i == $max && @is_file("$resolved/$bit")))
|
|
||||||
{
|
|
||||||
// Path Exists
|
|
||||||
if ($symlink_resolve && is_link("$resolved/$bit") && ($link = readlink("$resolved/$bit")))
|
|
||||||
{
|
|
||||||
// Resolved a symlink.
|
|
||||||
$resolved = $link . (($i == $max) ? '' : '/');
|
|
||||||
continue;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
else
|
|
||||||
{
|
|
||||||
// Something doesn't exist here!
|
|
||||||
// This is correct realpath() behaviour but sadly open_basedir and safe_mode make this problematic
|
|
||||||
// return false;
|
|
||||||
}
|
|
||||||
$resolved .= $bit . (($i == $max) ? '' : '/');
|
|
||||||
}
|
|
||||||
|
|
||||||
// @todo If the file exists fine and open_basedir only has one path we should be able to prepend it
|
|
||||||
// because we must be inside that basedir, the question is where...
|
|
||||||
// @internal The slash in is_dir() gets around an open_basedir restriction
|
|
||||||
if (!@file_exists($resolved) || (!is_dir($resolved . '/') && !is_file($resolved)))
|
|
||||||
{
|
|
||||||
return false;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Put the slashes back to the native operating systems slashes
|
|
||||||
$resolved = str_replace('/', DIRECTORY_SEPARATOR, $resolved);
|
|
||||||
|
|
||||||
return $resolved; // We got here, in the end!
|
|
||||||
}
|
}
|
||||||
|
|
||||||
|
// @todo If the file exists fine and open_basedir only has one path we should be able to prepend it
|
||||||
|
// because we must be inside that basedir, the question is where...
|
||||||
|
// @internal The slash in is_dir() gets around an open_basedir restriction
|
||||||
|
if (!@file_exists($resolved) || (!is_dir($resolved . '/') && !is_file($resolved)))
|
||||||
|
{
|
||||||
|
return false;
|
||||||
|
}
|
||||||
|
|
||||||
|
// Put the slashes back to the native operating systems slashes
|
||||||
|
$resolved = str_replace('/', DIRECTORY_SEPARATOR, $resolved);
|
||||||
|
|
||||||
|
return $resolved; // We got here, in the end!
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
else
|
else
|
||||||
|
|
|
||||||
Loading…
Add table
Reference in a new issue