Hi

As documented in the php manuals, open-basedir restricts the access to the specified directory and works as a prefix. So when I set "open_basedir=/www/1", I can access all directories staring with /www/1 (e.g. /www/10) with e.g. opendir(). To deavtivate the prefix-feature, the manual suggested to add a slash (/www/1/) to make the path absolute. 

The problem is that I am still able to access e.g. /www/10 with opendir(). I launched the sample script below from inside /www/3 and got a list of all other directories. However, access to e.g. /www/4 is blocked; so I assume it's a bug in the parsing of the path. The httpd.conf for this account contains the following directive: php_admin_value open_basedir /www/3/ so it should be safe (as documented in the php manual)


<?
getdir("/www/3/");
getdir("/www/30/");
getdir("/www/300");

function getdir ($directory)
        {
        print "<b>Trying $directory...</b><br>\n";
        if ($dir = @opendir("$directory"))
                {
                while (($file = readdir($dir)) !== false)
                        {
                        echo "$file<br>\n";
                        }
                closedir($dir);
                }
        print "<br><br>\n";
        }
?>