Description: ------------ The fixes for Bug #18056 appear to be too aggressive on a windows environment. I don't believe even the latest windows have anything like a symlink; so potentially checking the OS will fix this Test script: --------------- C:\pear\packages\Cache\trunk>pear upgrade pear Expected result: ---------------- No errors Actual result: -------------- C:\pear\packages\Cache\trunk>pear upgrade pear Error getting channel info from pear.php.net: SECURITY ERROR: Will not write to c:\tmp\cache\6d1f6e892384ae452db9a1bd59ee95f5rest.cache id as it is symlinked to c:\tmp\cache\6d1f6e892384ae452db9a1bd59ee95f5rest.cache id - Possible symlink att ack Nothing to upgrade C:\pear\packages\Cache\trunk>

Although PEAR_REST compares lstat['dev'] and fstat['dev'], those differ from each other on Windows even if it is a normal file. https://github.com/pear/pear-core/blob/e9b322b44e3389dde64b5dae9a3d1935a413a407/PEAR/REST.php#L286 Here is a testing code. ===== start of stat_test.php ===== <?php $tmpfile = tempnam('.', ''); $f = fopen($tmp, "w"); $fstat = fstat($f); fclose($f); $lstat = lstat($tmpfile); unlink $tmpfile; echo "lstat['dev']: $lstat['dev']\n"; echo "fstat['dev']: $fstat['dev']\n"; ===== end of stat_test.php ===== >:: on Windows 7 >php stat_test.php.txt lstat['dev']: 2 fstat['dev']: 0 $# on CentOS $ php stat_test.php lstat['dev']: 64768 fstat['dev']: 64768 How about using is_link() like PEAR_Downloader? https://github.com/pear/pear-core/blob/e9b322b44e3389dde64b5dae9a3d1935a413a407/PEAR/Downloader.php#L1711 It seems to be enough to check if the file is a symbolic link. >:: on Windows 7 >mklink link.txt target.txt symbolic link created for link.txt <<===>> target.txt >php -r "var_dump(is_link('target.txt'));" bool(false) >php -r "var_dump(is_link('link.txt'));" bool(true)

As a quick fix, I commented out line 286 in REST.php: $cachefile_lstat['dev'] == $cachefile_fstat['dev'] && And that seemed to fix it on Windows 7. Quick and dirty, I know.

Added a pull request: https://github.com/pear/pear-core/pull/30 This fixes another issue: if an actual symlink attack was tried, the file would be truncated BEFORE checking for a symlink due to 'wb' fopen() mode.

This bug has been fixed in SVN. If this was a documentation problem, the fix will appear on pear.php.net by the end of next Sunday (CET). If this was a problem with the pear.php.net website, the change should be live shortly. Otherwise, the fix will appear in the package's next release. Thank you for the report and for helping us make PEAR better.

Cherry-picked into stable for 1.9.5.