Re: [PECL-DEV] New chmlib PHP binding
[email protected] ("Gustavo Lopes")
| Newsgroups | php.pecl.dev |
|---|---|
| Organization | Núcleo de Eng. Biomédica do IST |
| Message-ID | <op.vhlh9dsxidpuyk@cataphract-old> |
On Tue, 17 Aug 2010 09:28:09 +0100, Jesús Espino <[email protected]> wrote: > On Sun, Aug 15, 2010 at 3:44 PM, Gustavo Lopes <[email protected]> > wrote: >> On Sat, 14 Aug 2010 14:55:52 +0100, Jesús Espino <[email protected]> >> wrote: >> >>> Thanks. >>> >>> I think i follow all your suggestions, I have pushed the changes to >>> the repository, any other suggestion?? >> >> I've noticed you open the file directly, without obeying >> >> 1) open_basedir/safe mode restrictions >> 2) the virtual current directory >> >> If the library you're wrapping supports receiving FILE* pointer, you can >> open the file with PHP's stream functions and cast the stream to FILE*. >> If it only accepts paths, you must do the checks and expand the path >> yourself. See e.g. here: >> >> http://lxr.php.net/opengrok/xref/PECL/rar/rararch.c#523 >> > > The library only have a filename input parameter, then i have a > question, is apropiated to make in the binding the function that > accept FILE objects or String objects, and then put it in a temporary > file, or is better to not give this options to the user?? Anyway i > will try to send a patch to the upstream developer to accept FILE > objects. > Well, my knowledge of the vast PHP streams API is sketchy, but that's what _php_stream_cast does for the (PHP_STREAM_AS_STDIO | PHP_STREAM_CAST_TRY_HARD) cast when there's no fopencookie -- it creates a temporary file, copies everything there and casts that instead. So I suppose you could create a temporary file (but not with php_stream_fopen_tmpfile(), because the structure where the filename is stored isn't public), copy the data there by reading the PHP stream and pass the path of the temporary file name. It would be better if the library supported FILE* pointers. If it's not possible, I'd say just do the checks yourself and pass the expanded path, because the copy has a performance penalty. The only occasion I'd go for the temp file would be if I needed to support all the stream wrappers PHP supports (http://, user wrappers, etc) or arbitrary PHP streams. -- Gustavo Lopes