[TYPO3-core] RFC #8130: Bug: addService() working with open_basedir and symlink

[Xavier Perseguers]

REMINDER #1 (-bis)

as first was sent on 02.05 as a new post and thus not related to this bug.

Xavier

Xavier Perseguers wrote:
> Hi,
> 
> Reminder for this open discussion...
> 
> I checked the official PHP site 
> (http://ch2.php.net/manual/en/features.safe-mode.php) and found a 
> explanation for the bug:
> 
> -- 
> When a script tries to open a file with, for example, fopen() or 
> gzopen(), the location of the file is checked. When the file is outside 
> the specified directory-tree, PHP will refuse to open it. All symbolic 
> links are resolved, so it's not possible to avoid this restriction with 
> a symlink. If the file doesn't exist then the symlink couldn't be 
> resolved and the filename is compared to (a resolved) open_basedir
> -- 
> 
> That is, is_executable() or is_link() on a symbolic link located in a 
> open_basedir directory cannot be handled. Please read again my bug report:
> 
> http://bugs.typo3.org/view.php?id=8130
> 
> I really think my patch should be applied to the core.
> 
> Regards,