|   | php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login | 
| 
  [2005-04-27 12:05 UTC] stegelmann at rz dot rwth-aachen dot de
 Description:
------------
We have some Apache/1.3.31 vhosts with open_basedir restrictions:
php_admin_value open_basedir "/export/home/websites/it/:/export2/home/websites/it/:/tmp/:/var/tmp/"
/export/home/websites/it/ is a symlink to the directory /export2/home/websites/it/ .
A script writing to an existing file in /export/home/websites/it/ works without a flaw.
Removing the file (so the script should create the file) produces an open_basedir warning.
(The creation of a file in the real directory /export2/home/websites/it/ works.)
I've already checked the (symlink-)ownership and directory-permissions. safe_mode is disabled for testing purposes.
Reproduce code:
---------------
<?
  $f = fopen("/export/home/websites/it/test", "w");
?>
Expected result:
----------------
As the file's path is in the allowed paths the file should be created (as it can be read when it exists).
Actual result:
--------------
Warning: fopen(): open_basedir restriction in effect. File(/export/home/websites/it/test) is not within the allowed path(s): (/export/home/websites/it:/export2/home/websites/it:/tmp/:/var/tmp/) in /export2/home/websites/it/test.php on line 2
Warning: fopen(/export/home/websites/it/test): failed to open stream: Not owner in /export2/home/websites/it/test.php on line 2
PatchesPull RequestsHistoryAllCommentsChangesGit/SVN commits             | |||||||||||||||||||||||||||||||||||||
|  Copyright © 2001-2025 The PHP Group All rights reserved. | Last updated: Fri Oct 31 16:00:01 2025 UTC | 
Does this work: $f = fopen("/export2/home/websites/it/test", "w"); ie. writing to the actual directory..?$f = fopen("/export2/home/websites/it/test", "w"); does work.To perhaps clarify - after the file was created with your code: $f = fopen("/export2/home/websites/it/test", "w"); the previously unsuccessful attempt: $f = fopen("/export/home/websites/it/test", "w"); does work (as I mentioned in the initial report). So just the file's creation fails in combination with the symlink.I suppose the problem lies with the fact that symlinks in open_basedir are getting resolved, while symlinks in fopen-calls aren't. For example, we have open_basedir /home/bla:/home2/bla and symlink /home/bla -> /home2/bla. The following fopen calls fails: fopen("/home/bla/foobar","w"); since the open_basedir virtually gets resolved to /home2/bla:/home2/bla (as documented in the php docs). What is not documented and I still think is a bug (even after reading #32851, #31309 and some not very friendly comment by tony2001 in #30188) is the fact that the symlink within the directory of the destination path is not getting resolved. One can not use any path within "/home/bla" for file creating (or upload moving) as the open_basedir values have their symlinks resolved while the destination files haven't. We solved it by symlinking a subdirectory of /home/bla to /home2/bla and using that one, as this solution doesn't use a symlinked path in the open_basedir setting which would get resolved. I still think it should be possible to set an open_basedir restriction to a symlink without running into the above-mentioned problem, e.g. by also resolving the symlink in the destination filenames. This has been verified with php4-STABLE-200509291243 and by looking at the source of php5-STABLE-200509291239.