diff --git a/ChangeLog b/ChangeLog index ff0360268..68c768fdd 100755 --- a/ChangeLog +++ b/ChangeLog @@ -10,6 +10,8 @@ $Source$ not displayed anymore * read_dump.php: bug #1033133, left frame not reloaded after dump read * db_datadict.php: bug #1034299, error in SHOW KEYS for data dict + * read_dump.php: bug #1034216 open_basedir and file upload, + thanks to Dominique Rousseau - domi 2004-09-24 Michal Čihař * libraries/export/sql.php: Fixed export of '0' string (bug #1033869). diff --git a/read_dump.php b/read_dump.php index f9832f1a8..c9d1e14d9 100644 --- a/read_dump.php +++ b/read_dump.php @@ -76,8 +76,14 @@ if ($sql_file != 'none') { // loic1 : fixed a security issue // if ((file_exists($sql_file) && is_uploaded_file($sql_file)) // || file_exists($cfg['UploadDir'] . $sql_localfile)) { - if (file_exists($sql_file) - && ((isset($sql_localfile) && $sql_file == $cfg['UploadDir'] . $sql_localfile) || is_uploaded_file($sql_file))) { + + // file_exists() returns false if open_basedir is set + //if (file_exists($sql_file) + // && ((isset($sql_localfile) && $sql_file == $cfg['UploadDir'] . $sql_localfile) || is_uploaded_file($sql_file))) { + + if ((is_uploaded_file($sql_file)) + ||(isset($sql_localfile) && $sql_file == $cfg['UploadDir'] . $sql_localfile) && file_exists($sql_file)) { + $open_basedir = @ini_get('open_basedir'); if (!isset($sql_file_compression)) $sql_file_compression = '';