Download | Plain Text | No Line Numbers 

  1. --- support/suexec.c.orig	Sat May 12 01:48:55 2007
  2. +++ support/suexec.c	Sat May 12 01:47:51 2007
  3. @@ -258,6 +258,7 @@
  4.      struct group *gr;       /* group entry holder        */
  5.      struct stat dir_info;   /* directory info holder     */
  6.      struct stat prg_info;   /* program info holder       */
  7. +    int skip_checks = 0;
  8.  
  9.      /*
  10.       * Start with a "clean" environment
  11. @@ -509,7 +510,21 @@
  12.          }
  13.      }
  14.  
  15. -    if ((strncmp(cwd, dwd, strlen(dwd))) != 0) {
  16. +    const char *phpcgipath1 = "/usr/lib/php5/bin";
  17. +    const char *phpcgipath2 = "/usr/lib/php4/bin";
  18. +    const char *phpcgipath3 = "/usr/local/bin";
  19. +    const char *phpcgiexec1 = "php-cgi-wrapper";
  20. +    const char *phpcgiexec2 = "phps-cgi-wrapper";
  21. +    if ((!strncmp(cwd, phpcgipath1, strlen(phpcgipath1)) ||
  22. +        !strncmp(cwd, phpcgipath2, strlen(phpcgipath2)) ||
  23. +        !strncmp(cwd, phpcgipath3, strlen(phpcgipath3))) &&
  24. +        !strncmp(cmd, phpcgiexec1, strlen(phpcgiexec1)) ||
  25. +        !strncmp(cmd, phpcgiexec2, strlen(phpcgiexec2))) {
  26. +        skip_checks = 1;
  27. +    }
  28. +
  29. +    if (!skip_checks &&
  30. +        (strncmp(cwd, dwd, strlen(dwd))) != 0) {
  31.          log_err("command not in docroot (%s/%s)\n", cwd, cmd);
  32.          exit(114);
  33.      }
  34. @@ -558,10 +571,11 @@
  35.       * Error out if the target name/group is different from
  36.       * the name/group of the cwd or the program.
  37.       */
  38. -    if ((uid != dir_info.st_uid) ||
  39. +    if (!skip_checks &&
  40. +        ((uid != dir_info.st_uid) ||
  41.          (gid != dir_info.st_gid) ||
  42.          (uid != prg_info.st_uid) ||
  43. -        (gid != prg_info.st_gid)) {
  44. +        (gid != prg_info.st_gid))) {
  45.          log_err("target uid/gid (%ld/%ld) mismatch "
  46.                  "with directory (%ld/%ld) or program (%ld/%ld)\n",
  47.                  uid, gid,
  48.