Skip to content

Commit fbb6a27

Browse files
committed
Merge branch 'PHP-7.1' into PHP-7.2
* PHP-7.1: Fix bug #77967 - Bypassing open_basedir restrictions via file uris
2 parents dc1d99e + c34895e commit fbb6a27

File tree

1 file changed

+9
-0
lines changed

1 file changed

+9
-0
lines changed

ext/sqlite3/sqlite3.c

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2071,6 +2071,15 @@ static int php_sqlite3_authorizer(void *autharg, int access_type, const char *ar
20712071
case SQLITE_ATTACH:
20722072
{
20732073
if (memcmp(arg3, ":memory:", sizeof(":memory:")) && *arg3) {
2074+
if (strncmp(arg3, "file:", 5) == 0) {
2075+
/* starts with "file:" */
2076+
if (!arg3[5]) {
2077+
return SQLITE_DENY;
2078+
}
2079+
if (php_check_open_basedir(arg3 + 5)) {
2080+
return SQLITE_DENY;
2081+
}
2082+
}
20742083
if (php_check_open_basedir(arg3)) {
20752084
return SQLITE_DENY;
20762085
}

0 commit comments

Comments
 (0)