File 0007-php-7.0.x-fpm-user-ini-docroot.patch of Package scl-php71

Overview Repositories Revisions Requests Users Attributes Meta

File 0007-php-7.0.x-fpm-user-ini-docroot.patch of Package scl-php71

From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Tim Mullin <tim@cpanel.net>
Date: Fri, 9 Nov 2018 19:01:51 -0600
Subject: [PATCH 07/15] php-7.0.x-fpm-user-ini-docroot

---
 sapi/fpm/fpm/fpm_main.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/sapi/fpm/fpm/fpm_main.c b/sapi/fpm/fpm/fpm_main.c
index 50f92981..cb25aa20 100644
--- a/sapi/fpm/fpm/fpm_main.c
+++ b/sapi/fpm/fpm/fpm_main.c
@@ -685,6 +685,9 @@ static void php_cgi_ini_activate_user_config(char *path, int path_len, const cha
 
 	/* Check whether cache entry has expired and rescan if it is */
 	if (request_time > entry->expires) {
+		char pwnambuf[4096 + 256];
+		struct passwd pwd, *pwdp;
+		long homedirlen;
 		char * real_path;
 		int real_path_len;
 		char *s1, *s2;
@@ -713,6 +716,15 @@ static void php_cgi_ini_activate_user_config(char *path, int path_len, const cha
 			s_len = path_len;
 		}
 
+		/* Find our home directory, and ensure the document root is within it.
+		 */
+		if (getpwuid_r(geteuid(), &pwd, pwnambuf, sizeof(pwnambuf), &pwdp) || !pwdp || !pwdp->pw_dir)
+			return;
+
+		homedirlen = strlen(pwdp->pw_dir);
+		if (strncmp(doc_root, pwdp->pw_dir, homedirlen) || doc_root[homedirlen] != '/')
+			return;
+
 		/* we have to test if path is part of DOCUMENT_ROOT.
 		  if it is inside the docroot, we scan the tree up to the docroot
 			to find more user.ini, if not we only scan the current path.

Places

File 0007-php-7.0.x-fpm-user-ini-docroot.patch of Package scl-php71

Places