Home » Images » Image_Barcode » Bug #8301

[2006-07-27 02:02 UTC] alan dot levee at prometheus-designs dot net

Description:
------------
The Pear package Image_Barcode uses coding in it's function Image_Barcode::draw() which causes problems with people running PHP in Safe Mode.

This is because the function uses opendir() and closedir() to validate if a dependancy is required rather than more safer checks such as MDB2::filExists() and MDB2::loadFile() which uses fopen and fclose to check the validatity of a file. To solve this issue I've made the following patch.

This was just a quick patch not a very thorough one but you're welcome to modify it to something a bit more organised similar to that of the two functions from MDB2 listed above.

Test script:
---------------
--- Barcode.php.new 2006-07-26 20:55:29.000000000 -0500
+++ Barcode.php 2006-07-26 20:41:30.000000000 -0500
@@ -62,13 +62,17 @@

// Check if include file exists
$barcodepath = PEAR_INSTALL_DIR . DIRECTORY_SEPARATOR . "Image" . DIRECTORY_SEPARATOR . "Barcode";
- $barcodefile = '/'.$type.'.php';
$supportedtypes = array();
-
- $fp = fopen($barcodepath.$barcodefile, 'r', true);
+ if ( $incdir = opendir($barcodepath) ) {
+ while ( false != ( $avaiabletype = readdir($incdir) ) ) {
+ if ( strstr($avaiabletype, ".php") ) {
+ $supportedtypes[] = $avaiabletype;
+ }
+ }
+ closedir($incdir);
+ }

- if (is_resource($fp)) {
- fclose($fp);
+ if ( in_array($type . ".php", $supportedtypes) ) {
include_once("Image/Barcode/${type}.php");
} else {
return PEAR::raiseError("$type barcode is not supported");

Expected result:
----------------
The expected result is that it should generate the image of the desired barcode but instead throws a Safe Mode Exception error instead due to the use of opendir() and closedir() rather than fopen() and fclose() similar to that of MDB2::filExists() and MDB2::loadFile()

Actual result:
--------------
PHP Warning: opendir(/usr/share/php/Image/Barcode) [function.opendir] failed to open dir: Success in /usr/share/php/Image/Barcode.php on line 66

[2006-07-27 02:03 UTC] alan dot levee at prometheus-designs dot net

First patch was generated wrong. Here is the correct patch
--- Barcode.php 2006-07-26 20:41:30.000000000 -0500
+++ Barcode.php.new 2006-07-26 20:55:29.000000000 -0500
@@ -62,17 +62,13 @@

// Check if include file exists
$barcodepath = PEAR_INSTALL_DIR . DIRECTORY_SEPARATOR . "Image" . DIRECTORY_SEPARATOR . "Barcode";
+ $barcodefile = '/'.$type.'.php';
$supportedtypes = array();
- if ( $incdir = opendir($barcodepath) ) {
- while ( false != ( $avaiabletype = readdir($incdir) ) ) {
- if ( strstr($avaiabletype, ".php") ) {
- $supportedtypes[] = $avaiabletype;
- }
- }
- closedir($incdir);
- }
+
+ $fp = fopen($barcodepath.$barcodefile, 'r', true);

- if ( in_array($type . ".php", $supportedtypes) ) {
+ if (is_resource($fp)) {
+ fclose($fp);
include_once("Image/Barcode/${type}.php");
} else {
return PEAR::raiseError("$type barcode is not supported");