After upgrade from 4.2.2 to 4.2.3 I have random error "open_basedir
restriction in effect. File is in wrong directory" at all apache virtual
servers (with open_basedir option and without).

Linux 2.2.21
 './configure' '--with-apxs=/usr/local/apache/bin/apxs' '--enable-EAPI'
'--enable-track-vars' '--with-mysql=/usr/local/mysql' '--with-jpeg-dir'
'--with-t1lib' '--enable-calendar' '--enable-sysvsem' '--enable-sysvshm'
'--enable-trans-sid' '--with-zlib' '--enable-ftp' '--enable-yp'
'--enable-memory-limit' '--with-gd' '--with-exec-dir' '--enable-sockets'
'--enable-safe-mode' '--with-exec-dir=/usr/local/php/bin'
'--with-pdflib=/usr/pdflib' '--with-imap' '--with-png-dir'
'--with-gettext' '--with-openssl=/usr/openssl/'

Could someone please check if this patch to 4.2.3 fixes this problem?

http://cvs.php.net/diff.php/php4/main/fopen_wrappers.c?login=2&r1=1.142.
2.3&r2=1.142.2.4&ty=u

I still have these random errors, but there is better with patch than
without patch. I have about few errors per hour at the server with 1MB/s
traffic.

Another update: This appears to be happening only to virtual hosts which
do not have the admin flag open_basedir set.

I have 2 FreeBSD servers with the same problem. Both have /www as
symlink. Real path is /home/www.
I also have a Windows machine, with no symlink ;-) - no problem there.
/www is c:/www there, and all works.
All machines have same httpd.conf, same Apache, same 4.2.3

Please try using this CVS snapshot:

  http://snaps.php.net/php4-STABLE-latest.tar.gz
 
For Windows:
 
  http://snaps.php.net/win32/php4-win32-STABLE-latest.zip

I fixed a bug that prevented resetting the open_basedir
by using 'php_admin_value open_basedir none'. 

This most likely fixes this problem for at least some of
you who have added comments to this report.

Patch can be found here:
http://cvs.php.net/diff.php/php4/main/main.c?login=2&r1=1.512.2.9&r2=1.5
12.2.10&ty=u

(should apply to 4.3.0 sources too)

[david at ols dot es] submitted some patches which supposedly
fix some of the issues, so please try the latest snapshot from today.

Please see bug http://bugs.php.net/bug.php?id=22480, as this seems to be
connected somewhat, but more critical (php source disclosure).

In the other vhost, set open_basedir to none

See bug #25753 (placeholder for all these reports about leaking php ini
settings)

This should now be fixed in CVS. Fix scheduled for PHP 4.3.5.