fopen_wrappers.c 22 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839
  1. /*
  2. +----------------------------------------------------------------------+
  3. | PHP Version 7 |
  4. +----------------------------------------------------------------------+
  5. | Copyright (c) 1997-2018 The PHP Group |
  6. +----------------------------------------------------------------------+
  7. | This source file is subject to version 3.01 of the PHP license, |
  8. | that is bundled with this package in the file LICENSE, and is |
  9. | available through the world-wide-web at the following url: |
  10. | http://www.php.net/license/3_01.txt |
  11. | If you did not receive a copy of the PHP license and are unable to |
  12. | obtain it through the world-wide-web, please send a note to |
  13. | license@php.net so we can mail you a copy immediately. |
  14. +----------------------------------------------------------------------+
  15. | Authors: Rasmus Lerdorf <rasmus@lerdorf.on.ca> |
  16. | Jim Winstead <jimw@php.net> |
  17. +----------------------------------------------------------------------+
  18. */
  19. /* {{{ includes
  20. */
  21. #include "php.h"
  22. #include "php_globals.h"
  23. #include "SAPI.h"
  24. #include <stdio.h>
  25. #include <stdlib.h>
  26. #include <errno.h>
  27. #include <sys/types.h>
  28. #include <sys/stat.h>
  29. #include <fcntl.h>
  30. #ifdef PHP_WIN32
  31. #define O_RDONLY _O_RDONLY
  32. #include "win32/param.h"
  33. #else
  34. #include <sys/param.h>
  35. #endif
  36. #include "ext/standard/head.h"
  37. #include "ext/standard/php_standard.h"
  38. #include "zend_compile.h"
  39. #include "php_network.h"
  40. #if HAVE_PWD_H
  41. #include <pwd.h>
  42. #endif
  43. #include <sys/types.h>
  44. #if HAVE_SYS_SOCKET_H
  45. #include <sys/socket.h>
  46. #endif
  47. #ifdef PHP_WIN32
  48. #include <winsock2.h>
  49. #else
  50. #include <netinet/in.h>
  51. #include <netdb.h>
  52. #if HAVE_ARPA_INET_H
  53. #include <arpa/inet.h>
  54. #endif
  55. #endif
  56. #if defined(PHP_WIN32) || defined(__riscos__)
  57. #undef AF_UNIX
  58. #endif
  59. #if defined(AF_UNIX)
  60. #include <sys/un.h>
  61. #endif
  62. /* }}} */
  63. /* {{{ OnUpdateBaseDir
  64. Allows any change to open_basedir setting in during Startup and Shutdown events,
  65. or a tightening during activation/runtime/deactivation */
  66. PHPAPI ZEND_INI_MH(OnUpdateBaseDir)
  67. {
  68. char **p, *pathbuf, *ptr, *end;
  69. #ifndef ZTS
  70. char *base = (char *) mh_arg2;
  71. #else
  72. char *base = (char *) ts_resource(*((int *) mh_arg2));
  73. #endif
  74. p = (char **) (base + (size_t) mh_arg1);
  75. if (stage == PHP_INI_STAGE_STARTUP || stage == PHP_INI_STAGE_SHUTDOWN || stage == PHP_INI_STAGE_ACTIVATE || stage == PHP_INI_STAGE_DEACTIVATE) {
  76. /* We're in a PHP_INI_SYSTEM context, no restrictions */
  77. *p = new_value ? ZSTR_VAL(new_value) : NULL;
  78. return SUCCESS;
  79. }
  80. /* Otherwise we're in runtime */
  81. if (!*p || !**p) {
  82. /* open_basedir not set yet, go ahead and give it a value */
  83. *p = ZSTR_VAL(new_value);
  84. return SUCCESS;
  85. }
  86. /* Shortcut: When we have a open_basedir and someone tries to unset, we know it'll fail */
  87. if (!new_value || !*ZSTR_VAL(new_value)) {
  88. return FAILURE;
  89. }
  90. /* Is the proposed open_basedir at least as restrictive as the current setting? */
  91. ptr = pathbuf = estrdup(ZSTR_VAL(new_value));
  92. while (ptr && *ptr) {
  93. end = strchr(ptr, DEFAULT_DIR_SEPARATOR);
  94. if (end != NULL) {
  95. *end = '\0';
  96. end++;
  97. }
  98. if (php_check_open_basedir_ex(ptr, 0) != 0) {
  99. /* At least one portion of this open_basedir is less restrictive than the prior one, FAIL */
  100. efree(pathbuf);
  101. return FAILURE;
  102. }
  103. ptr = end;
  104. }
  105. efree(pathbuf);
  106. /* Everything checks out, set it */
  107. *p = ZSTR_VAL(new_value);
  108. return SUCCESS;
  109. }
  110. /* }}} */
  111. /* {{{ php_check_specific_open_basedir
  112. When open_basedir is not NULL, check if the given filename is located in
  113. open_basedir. Returns -1 if error or not in the open_basedir, else 0.
  114. When open_basedir is NULL, always return 0.
  115. */
  116. PHPAPI int php_check_specific_open_basedir(const char *basedir, const char *path)
  117. {
  118. char resolved_name[MAXPATHLEN];
  119. char resolved_basedir[MAXPATHLEN];
  120. char local_open_basedir[MAXPATHLEN];
  121. char path_tmp[MAXPATHLEN];
  122. char *path_file;
  123. size_t resolved_basedir_len;
  124. size_t resolved_name_len;
  125. size_t path_len;
  126. int nesting_level = 0;
  127. /* Special case basedir==".": Use script-directory */
  128. if (strcmp(basedir, ".") || !VCWD_GETCWD(local_open_basedir, MAXPATHLEN)) {
  129. /* Else use the unmodified path */
  130. strlcpy(local_open_basedir, basedir, sizeof(local_open_basedir));
  131. }
  132. path_len = strlen(path);
  133. if (path_len > (MAXPATHLEN - 1)) {
  134. /* empty and too long paths are invalid */
  135. return -1;
  136. }
  137. /* normalize and expand path */
  138. if (expand_filepath(path, resolved_name) == NULL) {
  139. return -1;
  140. }
  141. path_len = strlen(resolved_name);
  142. memcpy(path_tmp, resolved_name, path_len + 1); /* safe */
  143. while (VCWD_REALPATH(path_tmp, resolved_name) == NULL) {
  144. #if defined(PHP_WIN32) || defined(HAVE_SYMLINK)
  145. if (nesting_level == 0) {
  146. ssize_t ret;
  147. char buf[MAXPATHLEN];
  148. ret = php_sys_readlink(path_tmp, buf, MAXPATHLEN - 1);
  149. if (ret == -1) {
  150. /* not a broken symlink, move along.. */
  151. } else {
  152. /* put the real path into the path buffer */
  153. memcpy(path_tmp, buf, ret);
  154. path_tmp[ret] = '\0';
  155. }
  156. }
  157. #endif
  158. #ifdef PHP_WIN32
  159. path_file = strrchr(path_tmp, DEFAULT_SLASH);
  160. if (!path_file) {
  161. path_file = strrchr(path_tmp, '/');
  162. }
  163. #else
  164. path_file = strrchr(path_tmp, DEFAULT_SLASH);
  165. #endif
  166. if (!path_file) {
  167. /* none of the path components exist. definitely not in open_basedir.. */
  168. return -1;
  169. } else {
  170. path_len = path_file - path_tmp + 1;
  171. #ifdef PHP_WIN32
  172. if (path_len > 1 && path_tmp[path_len - 2] == ':') {
  173. if (path_len != 3) {
  174. return -1;
  175. }
  176. /* this is c:\ */
  177. path_tmp[path_len] = '\0';
  178. } else {
  179. path_tmp[path_len - 1] = '\0';
  180. }
  181. #else
  182. path_tmp[path_len - 1] = '\0';
  183. #endif
  184. }
  185. nesting_level++;
  186. }
  187. /* Resolve open_basedir to resolved_basedir */
  188. if (expand_filepath(local_open_basedir, resolved_basedir) != NULL) {
  189. size_t basedir_len = strlen(basedir);
  190. /* Handler for basedirs that end with a / */
  191. resolved_basedir_len = strlen(resolved_basedir);
  192. #ifdef PHP_WIN32
  193. if (basedir[basedir_len - 1] == PHP_DIR_SEPARATOR || basedir[basedir_len - 1] == '/') {
  194. #else
  195. if (basedir[basedir_len - 1] == PHP_DIR_SEPARATOR) {
  196. #endif
  197. if (resolved_basedir[resolved_basedir_len - 1] != PHP_DIR_SEPARATOR) {
  198. resolved_basedir[resolved_basedir_len] = PHP_DIR_SEPARATOR;
  199. resolved_basedir[++resolved_basedir_len] = '\0';
  200. }
  201. } else {
  202. resolved_basedir[resolved_basedir_len++] = PHP_DIR_SEPARATOR;
  203. resolved_basedir[resolved_basedir_len] = '\0';
  204. }
  205. resolved_name_len = strlen(resolved_name);
  206. if (path_tmp[path_len - 1] == PHP_DIR_SEPARATOR) {
  207. if (resolved_name[resolved_name_len - 1] != PHP_DIR_SEPARATOR) {
  208. resolved_name[resolved_name_len] = PHP_DIR_SEPARATOR;
  209. resolved_name[++resolved_name_len] = '\0';
  210. }
  211. }
  212. /* Check the path */
  213. #ifdef PHP_WIN32
  214. if (strncasecmp(resolved_basedir, resolved_name, resolved_basedir_len) == 0) {
  215. #else
  216. if (strncmp(resolved_basedir, resolved_name, resolved_basedir_len) == 0) {
  217. #endif
  218. if (resolved_name_len > resolved_basedir_len &&
  219. resolved_name[resolved_basedir_len - 1] != PHP_DIR_SEPARATOR) {
  220. return -1;
  221. } else {
  222. /* File is in the right directory */
  223. return 0;
  224. }
  225. } else {
  226. /* /openbasedir/ and /openbasedir are the same directory */
  227. if (resolved_basedir_len == (resolved_name_len + 1) && resolved_basedir[resolved_basedir_len - 1] == PHP_DIR_SEPARATOR) {
  228. #ifdef PHP_WIN32
  229. if (strncasecmp(resolved_basedir, resolved_name, resolved_name_len) == 0) {
  230. #else
  231. if (strncmp(resolved_basedir, resolved_name, resolved_name_len) == 0) {
  232. #endif
  233. return 0;
  234. }
  235. }
  236. return -1;
  237. }
  238. } else {
  239. /* Unable to resolve the real path, return -1 */
  240. return -1;
  241. }
  242. }
  243. /* }}} */
  244. PHPAPI int php_check_open_basedir(const char *path)
  245. {
  246. return php_check_open_basedir_ex(path, 1);
  247. }
  248. /* {{{ php_check_open_basedir
  249. */
  250. PHPAPI int php_check_open_basedir_ex(const char *path, int warn)
  251. {
  252. /* Only check when open_basedir is available */
  253. if (PG(open_basedir) && *PG(open_basedir)) {
  254. char *pathbuf;
  255. char *ptr;
  256. char *end;
  257. /* Check if the path is too long so we can give a more useful error
  258. * message. */
  259. if (strlen(path) > (MAXPATHLEN - 1)) {
  260. php_error_docref(NULL, E_WARNING, "File name is longer than the maximum allowed path length on this platform (%d): %s", MAXPATHLEN, path);
  261. errno = EINVAL;
  262. return -1;
  263. }
  264. pathbuf = estrdup(PG(open_basedir));
  265. ptr = pathbuf;
  266. while (ptr && *ptr) {
  267. end = strchr(ptr, DEFAULT_DIR_SEPARATOR);
  268. if (end != NULL) {
  269. *end = '\0';
  270. end++;
  271. }
  272. if (php_check_specific_open_basedir(ptr, path) == 0) {
  273. efree(pathbuf);
  274. return 0;
  275. }
  276. ptr = end;
  277. }
  278. if (warn) {
  279. php_error_docref(NULL, E_WARNING, "open_basedir restriction in effect. File(%s) is not within the allowed path(s): (%s)", path, PG(open_basedir));
  280. }
  281. efree(pathbuf);
  282. errno = EPERM; /* we deny permission to open it */
  283. return -1;
  284. }
  285. /* Nothing to check... */
  286. return 0;
  287. }
  288. /* }}} */
  289. /* {{{ php_fopen_and_set_opened_path
  290. */
  291. static FILE *php_fopen_and_set_opened_path(const char *path, const char *mode, zend_string **opened_path)
  292. {
  293. FILE *fp;
  294. if (php_check_open_basedir((char *)path)) {
  295. return NULL;
  296. }
  297. fp = VCWD_FOPEN(path, mode);
  298. if (fp && opened_path) {
  299. //TODO :avoid reallocation
  300. char *tmp = expand_filepath_with_mode(path, NULL, NULL, 0, CWD_EXPAND);
  301. if (tmp) {
  302. *opened_path = zend_string_init(tmp, strlen(tmp), 0);
  303. efree(tmp);
  304. }
  305. }
  306. return fp;
  307. }
  308. /* }}} */
  309. /* {{{ php_fopen_primary_script
  310. */
  311. PHPAPI int php_fopen_primary_script(zend_file_handle *file_handle)
  312. {
  313. char *path_info;
  314. char *filename = NULL;
  315. zend_string *resolved_path = NULL;
  316. size_t length;
  317. zend_bool orig_display_errors;
  318. path_info = SG(request_info).request_uri;
  319. #if HAVE_PWD_H
  320. if (PG(user_dir) && *PG(user_dir) && path_info && '/' == path_info[0] && '~' == path_info[1]) {
  321. char *s = strchr(path_info + 2, '/');
  322. if (s) { /* if there is no path name after the file, do not bother */
  323. char user[32]; /* to try open the directory */
  324. struct passwd *pw;
  325. #if defined(ZTS) && defined(HAVE_GETPWNAM_R) && defined(_SC_GETPW_R_SIZE_MAX)
  326. struct passwd pwstruc;
  327. long pwbuflen = sysconf(_SC_GETPW_R_SIZE_MAX);
  328. char *pwbuf;
  329. if (pwbuflen < 1) {
  330. return FAILURE;
  331. }
  332. pwbuf = emalloc(pwbuflen);
  333. #endif
  334. length = s - (path_info + 2);
  335. if (length > sizeof(user) - 1) {
  336. length = sizeof(user) - 1;
  337. }
  338. memcpy(user, path_info + 2, length);
  339. user[length] = '\0';
  340. #if defined(ZTS) && defined(HAVE_GETPWNAM_R) && defined(_SC_GETPW_R_SIZE_MAX)
  341. if (getpwnam_r(user, &pwstruc, pwbuf, pwbuflen, &pw)) {
  342. efree(pwbuf);
  343. return FAILURE;
  344. }
  345. #else
  346. pw = getpwnam(user);
  347. #endif
  348. if (pw && pw->pw_dir) {
  349. spprintf(&filename, 0, "%s%c%s%c%s", pw->pw_dir, PHP_DIR_SEPARATOR, PG(user_dir), PHP_DIR_SEPARATOR, s + 1); /* Safe */
  350. } else {
  351. filename = SG(request_info).path_translated;
  352. }
  353. #if defined(ZTS) && defined(HAVE_GETPWNAM_R) && defined(_SC_GETPW_R_SIZE_MAX)
  354. efree(pwbuf);
  355. #endif
  356. }
  357. } else
  358. #endif
  359. if (PG(doc_root) && path_info && (length = strlen(PG(doc_root))) &&
  360. IS_ABSOLUTE_PATH(PG(doc_root), length)) {
  361. size_t path_len = strlen(path_info);
  362. filename = emalloc(length + path_len + 2);
  363. memcpy(filename, PG(doc_root), length);
  364. if (!IS_SLASH(filename[length - 1])) { /* length is never 0 */
  365. filename[length++] = PHP_DIR_SEPARATOR;
  366. }
  367. if (IS_SLASH(path_info[0])) {
  368. length--;
  369. }
  370. strncpy(filename + length, path_info, path_len + 1);
  371. } else {
  372. filename = SG(request_info).path_translated;
  373. }
  374. if (filename) {
  375. resolved_path = zend_resolve_path(filename, strlen(filename));
  376. }
  377. if (!resolved_path) {
  378. if (SG(request_info).path_translated != filename) {
  379. if (filename) {
  380. efree(filename);
  381. }
  382. }
  383. /* we have to free SG(request_info).path_translated here because
  384. * php_destroy_request_info assumes that it will get
  385. * freed when the include_names hash is emptied, but
  386. * we're not adding it in this case */
  387. if (SG(request_info).path_translated) {
  388. efree(SG(request_info).path_translated);
  389. SG(request_info).path_translated = NULL;
  390. }
  391. return FAILURE;
  392. }
  393. zend_string_release_ex(resolved_path, 0);
  394. orig_display_errors = PG(display_errors);
  395. PG(display_errors) = 0;
  396. if (zend_stream_open(filename, file_handle) == FAILURE) {
  397. PG(display_errors) = orig_display_errors;
  398. if (SG(request_info).path_translated != filename) {
  399. if (filename) {
  400. efree(filename);
  401. }
  402. }
  403. if (SG(request_info).path_translated) {
  404. efree(SG(request_info).path_translated);
  405. SG(request_info).path_translated = NULL;
  406. }
  407. return FAILURE;
  408. }
  409. PG(display_errors) = orig_display_errors;
  410. if (SG(request_info).path_translated != filename) {
  411. if (SG(request_info).path_translated) {
  412. efree(SG(request_info).path_translated);
  413. }
  414. SG(request_info).path_translated = filename;
  415. }
  416. return SUCCESS;
  417. }
  418. /* }}} */
  419. /* {{{ php_resolve_path
  420. * Returns the realpath for given filename according to include path
  421. */
  422. PHPAPI zend_string *php_resolve_path(const char *filename, size_t filename_length, const char *path)
  423. {
  424. char resolved_path[MAXPATHLEN];
  425. char trypath[MAXPATHLEN];
  426. const char *ptr, *end, *p;
  427. const char *actual_path;
  428. php_stream_wrapper *wrapper;
  429. zend_string *exec_filename;
  430. if (!filename || CHECK_NULL_PATH(filename, filename_length)) {
  431. return NULL;
  432. }
  433. /* Don't resolve paths which contain protocol (except of file://) */
  434. for (p = filename; isalnum((int)*p) || *p == '+' || *p == '-' || *p == '.'; p++);
  435. if ((*p == ':') && (p - filename > 1) && (p[1] == '/') && (p[2] == '/')) {
  436. wrapper = php_stream_locate_url_wrapper(filename, &actual_path, STREAM_OPEN_FOR_INCLUDE);
  437. if (wrapper == &php_plain_files_wrapper) {
  438. if (tsrm_realpath(actual_path, resolved_path)) {
  439. return zend_string_init(resolved_path, strlen(resolved_path), 0);
  440. }
  441. }
  442. return NULL;
  443. }
  444. if ((*filename == '.' &&
  445. (IS_SLASH(filename[1]) ||
  446. ((filename[1] == '.') && IS_SLASH(filename[2])))) ||
  447. IS_ABSOLUTE_PATH(filename, filename_length) ||
  448. #ifdef PHP_WIN32
  449. /* This should count as an absolute local path as well, however
  450. IS_ABSOLUTE_PATH doesn't care about this path form till now. It
  451. might be a big thing to extend, thus just a local handling for
  452. now. */
  453. filename_length >=2 && IS_SLASH(filename[0]) && !IS_SLASH(filename[1]) ||
  454. #endif
  455. !path ||
  456. !*path) {
  457. if (tsrm_realpath(filename, resolved_path)) {
  458. return zend_string_init(resolved_path, strlen(resolved_path), 0);
  459. } else {
  460. return NULL;
  461. }
  462. }
  463. ptr = path;
  464. while (ptr && *ptr) {
  465. /* Check for stream wrapper */
  466. int is_stream_wrapper = 0;
  467. for (p = ptr; isalnum((int)*p) || *p == '+' || *p == '-' || *p == '.'; p++);
  468. if ((*p == ':') && (p - ptr > 1) && (p[1] == '/') && (p[2] == '/')) {
  469. /* .:// or ..:// is not a stream wrapper */
  470. if (p[-1] != '.' || p[-2] != '.' || p - 2 != ptr) {
  471. p += 3;
  472. is_stream_wrapper = 1;
  473. }
  474. }
  475. end = strchr(p, DEFAULT_DIR_SEPARATOR);
  476. if (end) {
  477. if (filename_length > (MAXPATHLEN - 2) || (end-ptr) > MAXPATHLEN || (end-ptr) + 1 + filename_length + 1 >= MAXPATHLEN) {
  478. ptr = end + 1;
  479. continue;
  480. }
  481. memcpy(trypath, ptr, end-ptr);
  482. trypath[end-ptr] = '/';
  483. memcpy(trypath+(end-ptr)+1, filename, filename_length+1);
  484. ptr = end+1;
  485. } else {
  486. size_t len = strlen(ptr);
  487. if (filename_length > (MAXPATHLEN - 2) || len > MAXPATHLEN || len + 1 + filename_length + 1 >= MAXPATHLEN) {
  488. break;
  489. }
  490. memcpy(trypath, ptr, len);
  491. trypath[len] = '/';
  492. memcpy(trypath+len+1, filename, filename_length+1);
  493. ptr = NULL;
  494. }
  495. actual_path = trypath;
  496. if (is_stream_wrapper) {
  497. wrapper = php_stream_locate_url_wrapper(trypath, &actual_path, STREAM_OPEN_FOR_INCLUDE);
  498. if (!wrapper) {
  499. continue;
  500. } else if (wrapper != &php_plain_files_wrapper) {
  501. if (wrapper->wops->url_stat) {
  502. php_stream_statbuf ssb;
  503. if (SUCCESS == wrapper->wops->url_stat(wrapper, trypath, 0, &ssb, NULL)) {
  504. return zend_string_init(trypath, strlen(trypath), 0);
  505. }
  506. }
  507. continue;
  508. }
  509. }
  510. if (tsrm_realpath(actual_path, resolved_path)) {
  511. return zend_string_init(resolved_path, strlen(resolved_path), 0);
  512. }
  513. } /* end provided path */
  514. /* check in calling scripts' current working directory as a fall back case
  515. */
  516. if (zend_is_executing() &&
  517. (exec_filename = zend_get_executed_filename_ex()) != NULL) {
  518. const char *exec_fname = ZSTR_VAL(exec_filename);
  519. size_t exec_fname_length = ZSTR_LEN(exec_filename);
  520. while ((--exec_fname_length < SIZE_MAX) && !IS_SLASH(exec_fname[exec_fname_length]));
  521. if (exec_fname_length > 0 &&
  522. filename_length < (MAXPATHLEN - 2) &&
  523. exec_fname_length + 1 + filename_length + 1 < MAXPATHLEN) {
  524. memcpy(trypath, exec_fname, exec_fname_length + 1);
  525. memcpy(trypath+exec_fname_length + 1, filename, filename_length+1);
  526. actual_path = trypath;
  527. /* Check for stream wrapper */
  528. for (p = trypath; isalnum((int)*p) || *p == '+' || *p == '-' || *p == '.'; p++);
  529. if ((*p == ':') && (p - trypath > 1) && (p[1] == '/') && (p[2] == '/')) {
  530. wrapper = php_stream_locate_url_wrapper(trypath, &actual_path, STREAM_OPEN_FOR_INCLUDE);
  531. if (!wrapper) {
  532. return NULL;
  533. } else if (wrapper != &php_plain_files_wrapper) {
  534. if (wrapper->wops->url_stat) {
  535. php_stream_statbuf ssb;
  536. if (SUCCESS == wrapper->wops->url_stat(wrapper, trypath, 0, &ssb, NULL)) {
  537. return zend_string_init(trypath, strlen(trypath), 0);
  538. }
  539. }
  540. return NULL;
  541. }
  542. }
  543. if (tsrm_realpath(actual_path, resolved_path)) {
  544. return zend_string_init(resolved_path, strlen(resolved_path), 0);
  545. }
  546. }
  547. }
  548. return NULL;
  549. }
  550. /* }}} */
  551. /* {{{ php_fopen_with_path
  552. * Tries to open a file with a PATH-style list of directories.
  553. * If the filename starts with "." or "/", the path is ignored.
  554. */
  555. PHPAPI FILE *php_fopen_with_path(const char *filename, const char *mode, const char *path, zend_string **opened_path)
  556. {
  557. char *pathbuf, *ptr, *end;
  558. char trypath[MAXPATHLEN];
  559. FILE *fp;
  560. size_t filename_length;
  561. zend_string *exec_filename;
  562. if (opened_path) {
  563. *opened_path = NULL;
  564. }
  565. if (!filename) {
  566. return NULL;
  567. }
  568. filename_length = strlen(filename);
  569. #ifndef PHP_WIN32
  570. (void) filename_length;
  571. #endif
  572. /* Relative path open */
  573. if ((*filename == '.')
  574. /* Absolute path open */
  575. || IS_ABSOLUTE_PATH(filename, filename_length)
  576. || (!path || !*path)
  577. ) {
  578. return php_fopen_and_set_opened_path(filename, mode, opened_path);
  579. }
  580. /* check in provided path */
  581. /* append the calling scripts' current working directory
  582. * as a fall back case
  583. */
  584. if (zend_is_executing() &&
  585. (exec_filename = zend_get_executed_filename_ex()) != NULL) {
  586. const char *exec_fname = ZSTR_VAL(exec_filename);
  587. size_t exec_fname_length = ZSTR_LEN(exec_filename);
  588. while ((--exec_fname_length < SIZE_MAX) && !IS_SLASH(exec_fname[exec_fname_length]));
  589. if ((exec_fname && exec_fname[0] == '[') || exec_fname_length <= 0) {
  590. /* [no active file] or no path */
  591. pathbuf = estrdup(path);
  592. } else {
  593. size_t path_length = strlen(path);
  594. pathbuf = (char *) emalloc(exec_fname_length + path_length + 1 + 1);
  595. memcpy(pathbuf, path, path_length);
  596. pathbuf[path_length] = DEFAULT_DIR_SEPARATOR;
  597. memcpy(pathbuf + path_length + 1, exec_fname, exec_fname_length);
  598. pathbuf[path_length + exec_fname_length + 1] = '\0';
  599. }
  600. } else {
  601. pathbuf = estrdup(path);
  602. }
  603. ptr = pathbuf;
  604. while (ptr && *ptr) {
  605. end = strchr(ptr, DEFAULT_DIR_SEPARATOR);
  606. if (end != NULL) {
  607. *end = '\0';
  608. end++;
  609. }
  610. if (snprintf(trypath, MAXPATHLEN, "%s/%s", ptr, filename) >= MAXPATHLEN) {
  611. php_error_docref(NULL, E_NOTICE, "%s/%s path was truncated to %d", ptr, filename, MAXPATHLEN);
  612. }
  613. fp = php_fopen_and_set_opened_path(trypath, mode, opened_path);
  614. if (fp) {
  615. efree(pathbuf);
  616. return fp;
  617. }
  618. ptr = end;
  619. } /* end provided path */
  620. efree(pathbuf);
  621. return NULL;
  622. }
  623. /* }}} */
  624. /* {{{ php_strip_url_passwd
  625. */
  626. PHPAPI char *php_strip_url_passwd(char *url)
  627. {
  628. register char *p, *url_start;
  629. if (url == NULL) {
  630. return "";
  631. }
  632. p = url;
  633. while (*p) {
  634. if (*p == ':' && *(p + 1) == '/' && *(p + 2) == '/') {
  635. /* found protocol */
  636. url_start = p = p + 3;
  637. while (*p) {
  638. if (*p == '@') {
  639. int i;
  640. for (i = 0; i < 3 && url_start < p; i++, url_start++) {
  641. *url_start = '.';
  642. }
  643. for (; *p; p++) {
  644. *url_start++ = *p;
  645. }
  646. *url_start=0;
  647. break;
  648. }
  649. p++;
  650. }
  651. return url;
  652. }
  653. p++;
  654. }
  655. return url;
  656. }
  657. /* }}} */
  658. /* {{{ expand_filepath
  659. */
  660. PHPAPI char *expand_filepath(const char *filepath, char *real_path)
  661. {
  662. return expand_filepath_ex(filepath, real_path, NULL, 0);
  663. }
  664. /* }}} */
  665. /* {{{ expand_filepath_ex
  666. */
  667. PHPAPI char *expand_filepath_ex(const char *filepath, char *real_path, const char *relative_to, size_t relative_to_len)
  668. {
  669. return expand_filepath_with_mode(filepath, real_path, relative_to, relative_to_len, CWD_FILEPATH);
  670. }
  671. /* }}} */
  672. /* {{{ expand_filepath_use_realpath
  673. */
  674. PHPAPI char *expand_filepath_with_mode(const char *filepath, char *real_path, const char *relative_to, size_t relative_to_len, int realpath_mode)
  675. {
  676. cwd_state new_state;
  677. char cwd[MAXPATHLEN];
  678. size_t copy_len;
  679. size_t path_len;
  680. if (!filepath[0]) {
  681. return NULL;
  682. }
  683. path_len = strlen(filepath);
  684. if (IS_ABSOLUTE_PATH(filepath, path_len)) {
  685. cwd[0] = '\0';
  686. } else {
  687. const char *iam = SG(request_info).path_translated;
  688. const char *result;
  689. if (relative_to) {
  690. if (relative_to_len > MAXPATHLEN-1U) {
  691. return NULL;
  692. }
  693. result = relative_to;
  694. memcpy(cwd, relative_to, relative_to_len+1U);
  695. } else {
  696. result = VCWD_GETCWD(cwd, MAXPATHLEN);
  697. }
  698. if (!result && (iam != filepath)) {
  699. int fdtest = -1;
  700. fdtest = VCWD_OPEN(filepath, O_RDONLY);
  701. if (fdtest != -1) {
  702. /* return a relative file path if for any reason
  703. * we cannot cannot getcwd() and the requested,
  704. * relatively referenced file is accessible */
  705. copy_len = path_len > MAXPATHLEN - 1 ? MAXPATHLEN - 1 : path_len;
  706. if (real_path) {
  707. memcpy(real_path, filepath, copy_len);
  708. real_path[copy_len] = '\0';
  709. } else {
  710. real_path = estrndup(filepath, copy_len);
  711. }
  712. close(fdtest);
  713. return real_path;
  714. } else {
  715. cwd[0] = '\0';
  716. }
  717. } else if (!result) {
  718. cwd[0] = '\0';
  719. }
  720. }
  721. new_state.cwd = estrdup(cwd);
  722. new_state.cwd_length = strlen(cwd);
  723. if (virtual_file_ex(&new_state, filepath, NULL, realpath_mode)) {
  724. efree(new_state.cwd);
  725. return NULL;
  726. }
  727. if (real_path) {
  728. copy_len = new_state.cwd_length > MAXPATHLEN - 1 ? MAXPATHLEN - 1 : new_state.cwd_length;
  729. memcpy(real_path, new_state.cwd, copy_len);
  730. real_path[copy_len] = '\0';
  731. } else {
  732. real_path = estrndup(new_state.cwd, new_state.cwd_length);
  733. }
  734. efree(new_state.cwd);
  735. return real_path;
  736. }
  737. /* }}} */
  738. /*
  739. * Local variables:
  740. * tab-width: 4
  741. * c-basic-offset: 4
  742. * End:
  743. * vim600: sw=4 ts=4 fdm=marker
  744. * vim<600: sw=4 ts=4
  745. */