|
|
php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login |
[2001-11-15 18:53 UTC] a dot genkin at utoronto dot ca
Under safe mode, fopen("filename", "w") fails to create a file if it doesn't exist, complaining about open_basedir restriction. However, the filename refers to the file in the directory configured in the open_basedir. Besides, if the same file is created manually, fopen() can open it for writing without any problems. The directory is writeable to the web server.
$dir = '/var/www/tmp/submit';
// Fails if the file doesn't exist.
// Succeeds if the file does exist
fopen( "$dir/file.txt", "w" ); // Fails if the file doesn't exist.
mkdir( "$dir/foo", 0700 ); // SUCCEEDS!!! Notice the same path.
PatchesPull RequestsHistoryAllCommentsChangesGit/SVN commits
|
|||||||||||||||||||||||||||||||||||||
Copyright © 2001-2025 The PHP GroupAll rights reserved. |
Last updated: Fri Oct 24 23:00:01 2025 UTC |
This problem has nothing to do with wrong file/directory modes. I'm quite sure that it is a bug in the PHP-realpath-code. Please consider the following setup layout: /var/www/ = symlink to /mnt/sda1/www /var/www/domain.com = apache document_root = php open_basedir /var/www/domain.com/test.html = test file for fopen() I've added some debug code to fopen_wrappers.c : php_error(E_NOTICE, "check_specific_open_basedir ( comparing resolved name %s to resolved_basedir %s )", resolved_name, resolved_basedir); if (strncmp(resolved_basedir, resolved_name, strlen(resolved_basedir)) == 0) { Trying to fopen("/var/www/domain.com/test.html") results in two cases: 1. /var/www/domain.com/test.html already exists PHP Warning: check_specific_open_basedir ( comparing resolved name /mnt/sda1/www/domain.com/test.html to resolved_basedir /mnt/sda1/www/domain.com/test.html ) -> fopen() succeeds 2. /var/www/domain.com/test.html does *not* exist PHP Warning: check_specific_open_basedir ( comparing resolved name /var/www/domain.com/test.html to resolved_basedir /mnt/sda1/www/domain.com/test.html ) -> fopen() fails with "open basedir restriction in effect"-error As you can see in the debug output, PHP does not correctly expand the file path if the file does not exists ! Trying to fopen("/mnt/sda1/www/domain.com/test.html") always succeeds because PHP does not need to expand the filename anymore (-> strncmp is always true ). Hajo (Linux 2.2 - PHP 4.0.6 - afaik the problem still exists in 4.1.X)As a workaround you can use relative paths in all of your fopen()-calls: fopen("./test.html") always works (I think php prepends the *expanded path* then -- see the last paragraph in my previous comment). HajoI could not reproduce this issue. Here's my layout for the virtual server (from httpd.conf): DocumentRoot /path_to_site/html Options FollowSymLinks php_admin_value open_basedir path_to_sitephp_admin_value doc_root path_to_site php_admin_value safe_mode_include_dir path_to_site safe_mode=on in php.ini PHP version: both 4.0.6 and 4.2.0RC2 create PHP-script at "path_to_site/html/scriptname" create directory "path_to_site/html/test" writable by the apache user, then make symlink "path_to_site/html/test2" to that directory <? $fh=fopen("$DOCUMENT_ROOT/test2/1.txt", "w"); fwrite($fh, "test\n"); echo $fh,"\n"; fclose($fh); mkdir("$DOCUMENT_ROOT/test2/xxx/",770); ?> lynx http://sitename/scriptname gives "Resource id#1" No errors found in php_error_log, looked at path_to_site/html/test2/ and saw there both 1.txt contained "test" and xxx subdirectory.