Check open basedir for #1555

the-djmaze · the-djmaze · commit 325c748acc84 · 2024-04-21T03:52:30.000+02:00
diff --git a/snappymail/v/0.0.0/app/libraries/RainLoop/Utils.php b/snappymail/v/0.0.0/app/libraries/RainLoop/Utils.php
@@ -134,11 +134,7 @@ public static function inOpenBasedir(string $name) : string
 	{
 		static $open_basedir;
 		if (null === $open_basedir) {
-			$open_basedir = \ini_get('open_basedir');
-			if ($open_basedir) {
-				\SnappyMail\Log::warning('OpenBasedir', "open_basedir restriction in effect. Allowed path(s): {$open_basedir}");
-			}
-			$open_basedir = \array_filter(\explode(PATH_SEPARATOR, $open_basedir));
+			$open_basedir = \array_filter(\explode(PATH_SEPARATOR, \ini_get('open_basedir')));
 		}
 		if ($open_basedir) {
 			foreach ($open_basedir as $dir) {
diff --git a/snappymail/v/0.0.0/app/libraries/snappymail/gpg/base.php b/snappymail/v/0.0.0/app/libraries/snappymail/gpg/base.php
@@ -484,7 +484,7 @@ protected function proc_close() : int
 	protected static function findBinary($name) : ?string
 	{
 		$binary = \trim((string) `which $name`);
-		if ($binary && \is_executable($binary)) {
+		if ($binary && \RainLoop\Utils::inOpenBasedir($binary) && \is_executable($binary)) {
 			return $binary;
 		}
 		$locations = \array_filter([

Original file line number	Diff line number	Diff line change
`@@ -134,11 +134,7 @@ public static function inOpenBasedir(string $name) : string`
`134`	`134`	`{`
`135`	`135`	`static $open_basedir;`
`136`	`136`	`if (null === $open_basedir) {`
`137`		`- $open_basedir = \ini_get('open_basedir');`
`138`		`- if ($open_basedir) {`
`139`		`- \SnappyMail\Log::warning('OpenBasedir', "open_basedir restriction in effect. Allowed path(s): {$open_basedir}");`
`140`		`- }`
`141`		`- $open_basedir = \array_filter(\explode(PATH_SEPARATOR, $open_basedir));`
	`137`	`+ $open_basedir = \array_filter(\explode(PATH_SEPARATOR, \ini_get('open_basedir')));`
`142`	`138`	`}`
`143`	`139`	`if ($open_basedir) {`
`144`	`140`	`foreach ($open_basedir as $dir) {`
Original file line number	Diff line number	Diff line change
`@@ -484,7 +484,7 @@ protected function proc_close() : int`
`484`	`484`	`protected static function findBinary($name) : ?string`
`485`	`485`	`{`
`486`	`486`	$binary = \trim((string) `which $name`);
`487`		`- if ($binary && \is_executable($binary)) {`
	`487`	`+ if ($binary && \RainLoop\Utils::inOpenBasedir($binary) && \is_executable($binary)) {`
`488`	`488`	`return $binary;`
`489`	`489`	`}`
`490`	`490`	`$locations = \array_filter([`