From 5979ed571f54e6f5bc63ce8e468145ea08388418 Mon Sep 17 00:00:00 2001 From: David Hedberg Date: Fri, 2 Jun 2017 09:58:28 +0200 Subject: [PATCH 1/4] SFTP: Add a NO_REALPATH option to put() --- phpseclib/Net/SFTP.php | 30 ++++++++++++++++++++---------- 1 file changed, 20 insertions(+), 10 deletions(-) diff --git a/phpseclib/Net/SFTP.php b/phpseclib/Net/SFTP.php index 40c97daf..52a4d2e5 100644 --- a/phpseclib/Net/SFTP.php +++ b/phpseclib/Net/SFTP.php @@ -96,25 +96,29 @@ define('NET_SFTP_CHANNEL', 0x100); /** * Reads data from a local file. */ -define('NET_SFTP_LOCAL_FILE', 1); +define('NET_SFTP_LOCAL_FILE', 0x1); /** * Reads data from a string. */ // this value isn't really used anymore but i'm keeping it reserved for historical reasons -define('NET_SFTP_STRING', 2); +define('NET_SFTP_STRING', 0x2); /** * Reads data from callback: * function callback($length) returns string to proceed, null for EOF */ -define('NET_SFTP_CALLBACK', 16); +define('NET_SFTP_CALLBACK', 0x10); /** * Resumes an upload */ -define('NET_SFTP_RESUME', 4); +define('NET_SFTP_RESUME', 0x4); /** * Append a local file to an already existing remote file */ -define('NET_SFTP_RESUME_START', 8); +define('NET_SFTP_RESUME_START', 0x8); +/** + * Skip canonicalizing the remote path + */ +define('NET_SFTP_NO_REALPATH', 0x20); /**#@-*/ /** @@ -1887,8 +1891,9 @@ class Net_SFTP extends Net_SSH2 * Currently, only binary mode is supported. As such, if the line endings need to be adjusted, you will need to take * care of that, yourself. * - * $mode can take an additional two parameters - NET_SFTP_RESUME and NET_SFTP_RESUME_START. These are bitwise AND'd with - * $mode. So if you want to resume upload of a 300mb file on the local file system you'd set $mode to the following: + * $mode can take three additional parameters - NET_SFTP_RESUME, NET_SFTP_RESUME_START and NET_SFTP_NO_REALPATH. These + * are bitwise AND'd with $mode. So if you want to resume upload of a 300mb file on the local file system you'd set $mode + * to the following: * * NET_SFTP_LOCAL_FILE | NET_SFTP_RESUME * @@ -1904,6 +1909,9 @@ class Net_SFTP extends Net_SSH2 * * Setting $local_start to > 0 or $mode | NET_SFTP_RESUME_START doesn't do anything unless $mode | NET_SFTP_LOCAL_FILE. * + * Passing self::NO_REALPATH skips canonicalization of the remote path; $remote_file will be passed verbatim to the + * remote host. + * * @param string $remote_file * @param string|resource $data * @param int $mode @@ -1920,9 +1928,11 @@ class Net_SFTP extends Net_SSH2 return false; } - $remote_file = $this->_realpath($remote_file); - if ($remote_file === false) { - return false; + if (!($mode & NET_SFTP_NO_REALPATH)) { + $remote_file = $this->_realpath($remote_file); + if ($remote_file === false) { + return false; + } } $this->_remove_from_stat_cache($remote_file); From 1564a27f6ee6f0410c29c34ff77ee47648b3d852 Mon Sep 17 00:00:00 2001 From: terrafrost Date: Mon, 5 Jun 2017 00:44:29 -0500 Subject: [PATCH 2/4] SFTP: make NO_REALPATH apply to get() as well --- phpseclib/Net/SFTP.php | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/phpseclib/Net/SFTP.php b/phpseclib/Net/SFTP.php index 52a4d2e5..390161c7 100644 --- a/phpseclib/Net/SFTP.php +++ b/phpseclib/Net/SFTP.php @@ -2163,9 +2163,11 @@ class Net_SFTP extends Net_SSH2 return false; } - $remote_file = $this->_realpath($remote_file); - if ($remote_file === false) { - return false; + if (!($mode & NET_SFTP_NO_REALPATH)) { + $remote_file = $this->_realpath($remote_file); + if ($remote_file === false) { + return false; + } } $packet = pack('Na*N2', strlen($remote_file), $remote_file, NET_SFTP_OPEN_READ, 0); From 55623933f351396d3a7d8241fb22d3583d97128b Mon Sep 17 00:00:00 2001 From: terrafrost Date: Mon, 5 Jun 2017 01:22:53 -0500 Subject: [PATCH 3/4] 1.0.7 release --- CHANGELOG.md | 6 ++++++ README.md | 2 +- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 49ac1ccb..bcd3cae4 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,11 @@ # Changelog +## 1.0.7 - 2017-06-05 + +- Crypt: fix OpenSSL engine on <= PHP 5.3.6 (#1122) +- Random: suppress possible E_DEPRECATED errors +- RSA: reset variables if bad key was loaded + ## 1.0.6 - 2017-05-07 - SSH2: don't use timeout value of 0 for fsockopen (#775) diff --git a/README.md b/README.md index a3f49dcd..21a2438a 100644 --- a/README.md +++ b/README.md @@ -36,7 +36,7 @@ AES, Blowfish, Twofish, SSH-1, SSH-2, SFTP, and X.509 * Composer compatible (PSR-0 autoloading) * Install using Composer: `composer require phpseclib/phpseclib ~1.0` * Install using PEAR: See [phpseclib PEAR Channel Documentation](http://phpseclib.sourceforge.net/pear.htm) -* [Download 1.0.6 as ZIP](http://sourceforge.net/projects/phpseclib/files/phpseclib1.0.6.zip/download) +* [Download 1.0.7 as ZIP](http://sourceforge.net/projects/phpseclib/files/phpseclib1.0.7.zip/download) ## Support From 0bb6c9b974cada100cad40f72ef186a199274f9b Mon Sep 17 00:00:00 2001 From: terrafrost Date: Mon, 5 Jun 2017 01:30:30 -0500 Subject: [PATCH 4/4] SFTP: rm NO_REALPATH changes --- phpseclib/Net/SFTP.php | 38 +++++++++++++------------------------- 1 file changed, 13 insertions(+), 25 deletions(-) diff --git a/phpseclib/Net/SFTP.php b/phpseclib/Net/SFTP.php index 390161c7..40c97daf 100644 --- a/phpseclib/Net/SFTP.php +++ b/phpseclib/Net/SFTP.php @@ -96,29 +96,25 @@ define('NET_SFTP_CHANNEL', 0x100); /** * Reads data from a local file. */ -define('NET_SFTP_LOCAL_FILE', 0x1); +define('NET_SFTP_LOCAL_FILE', 1); /** * Reads data from a string. */ // this value isn't really used anymore but i'm keeping it reserved for historical reasons -define('NET_SFTP_STRING', 0x2); +define('NET_SFTP_STRING', 2); /** * Reads data from callback: * function callback($length) returns string to proceed, null for EOF */ -define('NET_SFTP_CALLBACK', 0x10); +define('NET_SFTP_CALLBACK', 16); /** * Resumes an upload */ -define('NET_SFTP_RESUME', 0x4); +define('NET_SFTP_RESUME', 4); /** * Append a local file to an already existing remote file */ -define('NET_SFTP_RESUME_START', 0x8); -/** - * Skip canonicalizing the remote path - */ -define('NET_SFTP_NO_REALPATH', 0x20); +define('NET_SFTP_RESUME_START', 8); /**#@-*/ /** @@ -1891,9 +1887,8 @@ class Net_SFTP extends Net_SSH2 * Currently, only binary mode is supported. As such, if the line endings need to be adjusted, you will need to take * care of that, yourself. * - * $mode can take three additional parameters - NET_SFTP_RESUME, NET_SFTP_RESUME_START and NET_SFTP_NO_REALPATH. These - * are bitwise AND'd with $mode. So if you want to resume upload of a 300mb file on the local file system you'd set $mode - * to the following: + * $mode can take an additional two parameters - NET_SFTP_RESUME and NET_SFTP_RESUME_START. These are bitwise AND'd with + * $mode. So if you want to resume upload of a 300mb file on the local file system you'd set $mode to the following: * * NET_SFTP_LOCAL_FILE | NET_SFTP_RESUME * @@ -1909,9 +1904,6 @@ class Net_SFTP extends Net_SSH2 * * Setting $local_start to > 0 or $mode | NET_SFTP_RESUME_START doesn't do anything unless $mode | NET_SFTP_LOCAL_FILE. * - * Passing self::NO_REALPATH skips canonicalization of the remote path; $remote_file will be passed verbatim to the - * remote host. - * * @param string $remote_file * @param string|resource $data * @param int $mode @@ -1928,11 +1920,9 @@ class Net_SFTP extends Net_SSH2 return false; } - if (!($mode & NET_SFTP_NO_REALPATH)) { - $remote_file = $this->_realpath($remote_file); - if ($remote_file === false) { - return false; - } + $remote_file = $this->_realpath($remote_file); + if ($remote_file === false) { + return false; } $this->_remove_from_stat_cache($remote_file); @@ -2163,11 +2153,9 @@ class Net_SFTP extends Net_SSH2 return false; } - if (!($mode & NET_SFTP_NO_REALPATH)) { - $remote_file = $this->_realpath($remote_file); - if ($remote_file === false) { - return false; - } + $remote_file = $this->_realpath($remote_file); + if ($remote_file === false) { + return false; } $packet = pack('Na*N2', strlen($remote_file), $remote_file, NET_SFTP_OPEN_READ, 0);