代码拉取完成,页面将自动刷新
同步操作将从 src-openEuler/php 强制同步,此操作会覆盖自 Fork 仓库以来所做的任何修改,且无法恢复!!!
确定后同步将在后台操作,完成时将刷新页面,请耐心等待。
From 336d2086a9189006909ae06c7e95902d7d5ff77e Mon Sep 17 00:00:00 2001
From: Stanislav Malyshev <stas@php.net>
Date: Sun, 18 Nov 2018 17:10:43 -0800
Subject: [PATCH] Disable rsh/ssh functionality in imap by default (bug #77153)
---
NEWS | 4 ++++
UPGRADING | 7 +++++++
ext/imap/php_imap.c | 17 +++++++++++++++++
ext/imap/php_imap.h | 1 +
ext/imap/tests/bug77153.phpt | 24 ++++++++++++++++++++++++
5 files changed, 53 insertions(+)
create mode 100644 ext/imap/tests/bug77153.phpt
index ec2d8f46ed..52968a3857 100644
diff --git a/ext/imap/php_imap.c b/ext/imap/php_imap.c
index e1adcf2264..42e7d8611c 100644
--- a/ext/imap/php_imap.c
+++ b/ext/imap/php_imap.c
@@ -562,6 +562,15 @@ static const zend_module_dep imap_deps[] = {
};
/* }}} */
+
+/* {{{ PHP_INI
+ */
+PHP_INI_BEGIN()
+STD_PHP_INI_BOOLEAN("imap.enable_insecure_rsh", "0", PHP_INI_SYSTEM, OnUpdateBool, enable_rsh, zend_imap_globals, imap_globals)
+PHP_INI_END()
+/* }}} */
+
+
/* {{{ imap_module_entry
*/
zend_module_entry imap_module_entry = {
@@ -832,6 +841,8 @@ PHP_MINIT_FUNCTION(imap)
{
unsigned long sa_all = SA_MESSAGES | SA_RECENT | SA_UNSEEN | SA_UIDNEXT | SA_UIDVALIDITY;
+ REGISTER_INI_ENTRIES();
+
#ifndef PHP_WIN32
mail_link(&unixdriver); /* link in the unix driver */
mail_link(&mhdriver); /* link in the mh driver */
@@ -1049,6 +1060,12 @@ PHP_MINIT_FUNCTION(imap)
GC_TEXTS texts
*/
+ if (!IMAPG(enable_rsh)) {
+ /* disable SSH and RSH, see https://bugs.php.net/bug.php?id=77153 */
+ mail_parameters (NIL, SET_RSHTIMEOUT, 0);
+ mail_parameters (NIL, SET_SSHTIMEOUT, 0);
+ }
+
le_imap = zend_register_list_destructors_ex(mail_close_it, NULL, "imap", module_number);
return SUCCESS;
}
diff --git a/ext/imap/php_imap.h b/ext/imap/php_imap.h
index 7691d1fdd7..556163ed2d 100644
--- a/ext/imap/php_imap.h
+++ b/ext/imap/php_imap.h
@@ -231,6 +231,7 @@ ZEND_BEGIN_MODULE_GLOBALS(imap)
#endif
/* php_stream for php_mail_gets() */
php_stream *gets_stream;
+ zend_bool enable_rsh;
ZEND_END_MODULE_GLOBALS(imap)
#ifdef ZTS
diff --git a/ext/imap/tests/bug77153.phpt b/ext/imap/tests/bug77153.phpt
new file mode 100644
index 0000000000..63590aee1d
--- /dev/null
+++ b/ext/imap/tests/bug77153.phpt
@@ -0,0 +1,24 @@
+--TEST--
+Bug #77153 (imap_open allows to run arbitrary shell commands via mailbox parameter)
+--SKIPIF--
+<?php
+ if (!extension_loaded("imap")) {
+ die("skip imap extension not available");
+ }
+?>
+--FILE--
+<?php
+$payload = "echo 'BUG'> " . __DIR__ . '/__bug';
+$payloadb64 = base64_encode($payload);
+$server = "x -oProxyCommand=echo\t$payloadb64|base64\t-d|sh}";
+@imap_open('{'.$server.':143/imap}INBOX', '', '');
+// clean
+imap_errors();
+var_dump(file_exists(__DIR__ . '/__bug'));
+?>
+--EXPECT--
+bool(false)
+--CLEAN--
+<?php
+if(file_exists(__DIR__ . '/__bug')) unlink(__DIR__ . '/__bug');
+?>
\ No newline at end of file
--
2.11.0
此处可能存在不合适展示的内容,页面不予展示。您可通过相关编辑功能自查并修改。
如您确认内容无涉及 不当用语 / 纯广告导流 / 暴力 / 低俗色情 / 侵权 / 盗版 / 虚假 / 无价值内容或违法国家有关法律法规的内容,可点击提交进行申诉,我们将尽快为您处理。