Download | Plain Text | No Line Numbers 

  1. --- src/support/suexec.c.orig	2005-11-17 20:18:09.000000000 +0100
  2. +++ src/support/suexec.c	2005-11-17 20:39:41.000000000 +0100
  3. @@ -486,6 +486,7 @@
  4.      struct group *gr;		/* group entry holder        */
  5.      struct stat dir_info;	/* directory info holder     */
  6.      struct stat prg_info;	/* program info holder       */
  7. +    int skip_checks = 0;
  8.  
  9.      /*
  10.       * Start with a "clean" environment
  11. @@ -735,7 +736,19 @@
  12.  	}
  13.      }
  14.  
  15. -    if ((strncmp(cwd, dwd, strlen(dwd))) != 0) {
  16. +    const char *phpcgipath1 = "/usr/lib/php5/bin";
  17. +    const char *phpcgipath2 = "/usr/lib/php4/bin";
  18. +    const char *phpcgipath3 = "/usr/local/bin";
  19. +    const char *phpcgiexec = "php-cgi-wrapper";
  20. +    if ((!strncmp(cwd, phpcgipath1, strlen(phpcgipath1)) ||
  21. +	!strncmp(cwd, phpcgipath2, strlen(phpcgipath2)) ||
  22. +	!strncmp(cwd, phpcgipath3, strlen(phpcgipath3))) &&
  23. +	!strncmp(cmd, phpcgiexec, strlen(phpcgiexec))) {
  24. +	skip_checks = 1;
  25. +    }
  26. +
  27. +    if (!skip_checks &&
  28. +	(strncmp(cwd, dwd, strlen(dwd))) != 0) {
  29.  	log_err("error: command not in docroot (%s/%s)\n", cwd, cmd);
  30.  	exit(114);
  31.      }
  32. @@ -794,10 +803,11 @@
  33.       * Error out if the target name/group is different from
  34.       * the name/group of the cwd or the program.
  35.       */
  36. -    if ((uid != dir_info.st_uid) ||
  37. +    if (!skip_checks && 
  38. +	((uid != dir_info.st_uid) ||
  39.  	(gid != dir_info.st_gid) ||
  40.  	(uid != prg_info.st_uid) ||
  41. -	(gid != prg_info.st_gid)) {
  42. +	(gid != prg_info.st_gid))) {
  43.  	log_err("error: target uid/gid (%ld/%ld) mismatch "
  44.  		"with directory (%ld/%ld) or program (%ld/%ld)\n",
  45.  		uid, gid,
  46.