Skip to content

Commit 3f2a6e9

Browse files
committed
Fix bug #61094: Wrong WSDL cache file name
While filed as a request, this can actually cause problems with cache files. If there are multiple users running the same SOAP code, then they will attempt to use the same cache file, even if they don't have permission to that. See #12838 (comment) for a concrete example.
1 parent 65d5efd commit 3f2a6e9

File tree

1 file changed

+6
-5
lines changed

1 file changed

+6
-5
lines changed

ext/soap/php_sdl.c

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -3185,22 +3185,23 @@ sdlPtr get_sdl(zval *this_ptr, char *uri, zend_long cache_wsdl)
31853185
unsigned char digest[16];
31863186
size_t len = strlen(SOAP_GLOBAL(cache_dir));
31873187
time_t cached;
3188-
char *user = php_get_current_user();
3189-
size_t user_len = user ? strlen(user) + 1 : 0;
3188+
size_t user_len = 0;
3189+
char *user = php_get_current_running_user(&user_len);
31903190

31913191
md5str[0] = '\0';
31923192
PHP_MD5Init(&md5_context);
31933193
PHP_MD5Update(&md5_context, (unsigned char*)uri, uri_len);
31943194
PHP_MD5Final(digest, &md5_context);
31953195
make_digest(md5str, digest);
3196-
key = emalloc(len+sizeof("/wsdl-")-1+user_len+2+sizeof(md5str));
3196+
key = emalloc(len+sizeof("/wsdl-")-1+user_len+1+2+sizeof(md5str));
31973197
memcpy(key,SOAP_GLOBAL(cache_dir),len);
31983198
memcpy(key+len,"/wsdl-",sizeof("/wsdl-")-1);
31993199
len += sizeof("/wsdl-")-1;
32003200
if (user_len) {
3201-
memcpy(key+len, user, user_len-1);
3202-
len += user_len-1;
3201+
memcpy(key+len, user, user_len);
3202+
len += user_len;
32033203
key[len++] = '-';
3204+
efree(user);
32043205
}
32053206
if (WSDL_CACHE_VERSION <= 0x9f) {
32063207
key[len++] = (WSDL_CACHE_VERSION >> 8) + '0';

0 commit comments

Comments
 (0)