diff options
| author | Andrey Andreev <narf@bofh.bg> | 2012-11-07 13:23:29 +0100 |
|---|---|---|
| committer | Andrey Andreev <narf@bofh.bg> | 2012-11-07 13:23:29 +0100 |
| commit | e9d2dc85b9cb255aae235635576972e4b7dbd5a8 (patch) | |
| tree | 139d0ecbef12a87fabb34c64bc77e4d0e2670176 /system/libraries/Upload.php | |
| parent | 17e11cdf1c6ff23f00c3deb2a39a40ffeb446f5c (diff) | |
Added function_usable() to common functions
It is now used to check whether dangerous functions like eval() and exec() are available.
It appears that the Suhosin extension (which is becoming popular) terminates script
execution instead of returning e.g. FALSE when it has a function blacklisted.
function_exists() checks are insufficient and our only option is to check the ini
settings here.
Filed an issue here: https://github.com/stefanesser/suhosin/issues/18
... hopefully we'll be able to deal with this in a more elegant way in the future.
(this commit supersedes PR #1809)
Diffstat (limited to 'system/libraries/Upload.php')
| -rw-r--r-- | system/libraries/Upload.php | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/system/libraries/Upload.php b/system/libraries/Upload.php index 013644963..b3e9f7515 100644 --- a/system/libraries/Upload.php +++ b/system/libraries/Upload.php @@ -1208,7 +1208,7 @@ class CI_Upload { ? 'file --brief --mime '.escapeshellarg($file['tmp_name']).' 2>&1' : 'file --brief --mime '.$file['tmp_name'].' 2>&1'; - if (function_exists('exec')) + if (function_usable('exec')) { /* This might look confusing, as $mime is being populated with all of the output when set in the second parameter. * However, we only neeed the last line, which is the actual return value of exec(), and as such - it overwrites @@ -1223,7 +1223,7 @@ class CI_Upload { } } - if ( (bool) @ini_get('safe_mode') === FALSE && function_exists('shell_exec')) + if ( (bool) @ini_get('safe_mode') === FALSE && function_usable('shell_exec')) { $mime = @shell_exec($cmd); if (strlen($mime) > 0) @@ -1237,7 +1237,7 @@ class CI_Upload { } } - if (function_exists('popen')) + if (function_usable('popen')) { $proc = @popen($cmd, 'r'); if (is_resource($proc)) |