[TYPO3-core] RFC #8130: Bug: addService() working with open_basedir and symlink

[Xavier Perseguers]

REMINDER #2

I could not find a free core developer during the coding night...

Regards

-- 
Xavier Perseguers
http://xavier.perseguers.ch/en/tutorials/typo3.html



Xavier Perseguers wrote:
> REMINDER #1 (-bis)
> 
> Xavier
> 
> Xavier Perseguers wrote:
>> Hi,
>>
>> Reminder for this open discussion...
>>
>> I checked the official PHP site 
>> (http://ch2.php.net/manual/en/features.safe-mode.php) and found a 
>> explanation for the bug:
>>
>> -- 
>> When a script tries to open a file with, for example, fopen() or 
>> gzopen(), the location of the file is checked. When the file is 
>> outside the specified directory-tree, PHP will refuse to open it. All 
>> symbolic links are resolved, so it's not possible to avoid this 
>> restriction with a symlink. If the file doesn't exist then the symlink 
>> couldn't be resolved and the filename is compared to (a resolved) 
>> open_basedir
>> -- 
>>
>> That is, is_executable() or is_link() on a symbolic link located in a 
>> open_basedir directory cannot be handled. Please read again my bug 
>> report:
>>
>> http://bugs.typo3.org/view.php?id=8130
>>
>> I really think my patch should be applied to the core.
>>
>> Regards,