Fix #76359: open_basedir bypass through adding ".."

We explicitly forbid adding paths with a leading `..` to `open_basedir`
at runtime.

Closes GH-7024.

Fix handling of open_basedir that contains cwd

While resolving the path, the last step will reduce it down to ""
(an empty string) and realpath() will resolve this to getcwd().
If op

Fix handling of open_basedir that contains cwd

While resolving the path, the last step will reduce it down to ""
(an empty string) and realpath() will resolve this to getcwd().
If open_basedir contains the CWD, then that means open_basedir
will be bypassed for paths that don't have any components that
exist (if one of the components exists, then we abort the realpath
loop at that point).

Closes GH-7015.

show more ...

Make url_stats in resolve_path quiet

These stats are used to check whether the file exists -- they
should not generate errors. Having the flag set is particularly
important for custo

Make url_stats in resolve_path quiet

These stats are used to check whether the file exists -- they
should not generate errors. Having the flag set is particularly
important for custom stream wrappers.

show more ...

Properly propagate url_stat exceptions during include

Make sure we abort operations early, and that we don't emit
additional warnings or errors if an exception has been thrown.

Remove local variables

This patch removes the so called local variables defined per
file basis for certain editors to properly show tab width, and
similar settings. These are mainly

Remove local variables

This patch removes the so called local variables defined per
file basis for certain editors to properly show tab width, and
similar settings. These are mainly used by Vim and Emacs editors
yet with recent changes the once working definitions don't work
anymore in Vim without custom plugins or additional configuration.
Neither are these settings synced across the PHP code base.

A simpler and better approach is EditorConfig and fixing code
using some code style fixing tools in the future instead.

This patch also removes the so called modelines for Vim. Modelines
allow Vim editor specifically to set some editor configuration such as
syntax highlighting, indentation style and tab width to be set in the
first line or the last 5 lines per file basis. Since the php test
files have syntax highlighting already set in most editors properly and
EditorConfig takes care of the indentation settings, this patch removes
these as well for the Vim 6.0 and newer versions.

With the removal of local variables for certain editors such as
Emacs and Vim, the footer is also probably not needed anymore when
creating extensions using ext_skel.php script.

Additionally, Vim modelines for setting php syntax and some editor
settings has been removed from some *.phpt files. All these are
mostly not relevant for phpt files neither work properly in the
middle of the file.

show more ...

Remove yearly range from copyright notice

Remove unused Git attributes ident

The $Id$ keywords were used in Subversion where they can be substituted
with filename, last revision number change, last changed date, and last
use

Remove unused Git attributes ident

The $Id$ keywords were used in Subversion where they can be substituted
with filename, last revision number change, last changed date, and last
user who changed it.

In Git this functionality is different and can be done with Git attribute
ident. These need to be defined manually for each file in the
.gitattributes file and are afterwards replaced with 40-character
hexadecimal blob object name which is based only on the particular file
contents.

This patch simplifies handling of $Id$ keywords by removing them since
they are not used anymore.

show more ...

Use zend_string_release_ex() instread of zend_string_release() in places, where we sure about string persistence.

year++

year++

year++

Move cwd_state and path related routines to size_t

Having `int` there is no real profit in the size or speed, while unsigned
improves security and overall integration. ZPP supplied strin

Move cwd_state and path related routines to size_t

Having `int` there is no real profit in the size or speed, while unsigned
improves security and overall integration. ZPP supplied strings can
be then accepted directly and structs can be still handled with smaller
unsigned types for size reasons, which is safe. Yet some related places
are to go.

basic move tsrm_realpath_r to size_t

fix conditions and sync with affected places

touch ocurrences of php_sys_readlink usage

follow up on phar path handling

remove duplicated check

move zend_resolve_path and related pieces to size_t

touch yet resolve path related places

remove cast

missing pieces

missing piece

yet cleanups for php_sys_readlink for ssize_t

fix wrong return

show more ...

remove some casts

Fixed condition check

Remove more unnecessary checks on Zend's allocator functions

Update copyright headers to 2017

Update copyright headers to 2017

Update copyright headers to 2017

Remove Netware support

If this does not break the Unix system somehow, I'll be amazed. This should get most of it out, apologies for any errors this may cause on non-Windows ends which I can

Remove Netware support

If this does not break the Unix system somehow, I'll be amazed. This should get most of it out, apologies for any errors this may cause on non-Windows ends which I cannot test atm.

show more ...

Fix bug #73189 - Memcpy negative size parameter php_resolve_path

(cherry picked from commit da7e89cde880c66887caacd0a3eae7ecdacf9b2a)
(cherry picked from commit c4c2cce37dd99bbcf1411ad8d

Fix bug #73189 - Memcpy negative size parameter php_resolve_path

(cherry picked from commit da7e89cde880c66887caacd0a3eae7ecdacf9b2a)
(cherry picked from commit c4c2cce37dd99bbcf1411ad8d6884c3c927d7bc9)

show more ...

Fix bug #73189 - Memcpy negative size parameter php_resolve_path

(cherry picked from commit da7e89cde880c66887caacd0a3eae7ecdacf9b2a)

Fix bug #73189 - Memcpy negative size parameter php_resolve_path

Use size_t for path length

simplify expression

Fixed bug #72035 php-cgi.exe fails to run scripts relative to drive root