php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #22309 open_basedir: strange problems
Submitted: 2003-02-19 17:41 UTC Modified: 2003-02-23 16:41 UTC
From: Joerg dot Dieter dot Friedrich at uni-konstanz dot de Assigned:
Status: Not a bug Package: *Directory/Filesystem functions
PHP Version: 4.3.1 OS: Solaris 8
Private report: No CVE-ID: None
 [2003-02-19 17:41 UTC] Joerg dot Dieter dot Friedrich at uni-konstanz dot de
Hi!

First I know that there are a lot of different bugs concerning open_basedir, and I read recent ones, about 20. But this is all strange.

Second: My system is a Sparc U10
        Solaris 8 based.
        Apache 1.3.27 and PHP4.3.1
        This is my test system for out Webmailservice.

ATM there is a Horde-1.2.8/imp2.2.8 installed which is a identical copy from our working production system. This is in docroot of the apache. (Filesystem location: /opt/horde/htdocs/horde/imp). php.ini hase a include_path to /opt/horde/phplib, and the auto_prepend_file statement for phplib. open_basedir is set to 
".:/opt/php4/lib/php:/opt/horde2test:/var/tmp/ldapcache:/opt/horde:/var/webmail-attachments"


We are in the transition to Horde2.2.1/imp3.1.
I installed the new system into /opt/horde2test and
made an alias in apache's httpd.conf to https://<server>/imp3test and set via php_admin_value the prepend file to none and the include-path to php4.3.1/pear-directory. This is all still working fine.

But we have a small and dirty hack within the old horde/imp combo which is needed to get the userid from a ldapserver. The users have to use their mail-alias to login, but for the connection to the imapserver the userid is required. Our piece of code does only some ldap-queries and then tries to store the result in a file to speed up next login.

and the code to write these small files is this:

$pfad="/tmp/ldapcache/".$buchstabe1."/".$buchstabe2;
$filename=$pfad."/".$imp['user'];
$command="mkdir -m 0700 -p ".$pfad;
exec($command);       
$fd=fopen($filename,"w");
fwrite($fd,$imp['unipopid']); fwrite($fd,"\n");
fclose($fd);          


In Horde1/imp2 there is no error the files are created.
In Horde2/imp3 I always get:

[19-Feb-2003 21:06:37] PHP Warning:fopen()]: open_basedir restriction in effect. File(/tmp/ldapcache/j/f/joerg.dieter.friedrich) is not within the allowed path(s): (.) in /opt/horde2test/htdocs/horde/imp/lib/IMP.php on line 166
[19-Feb-2003 21:06:37] PHP Warning:  fopen(/tmp/ldapcache/j/f/joerg.dieter.friedrich): failed to create stream: Not owner in /opt/horde2test/htdocs/horde/imp/lib/IMP.php on line 166
[19-Feb-2003 21:06:37] PHP Warning:  fwrite(): supplied argument is not a valid stream resource in /opt/horde2test/htdocs/horde/imp/lib/IMP.php on line 167
[19-Feb-2003 21:06:37] PHP Warning:  fwrite(): supplied argument is not a valid stream resource in /opt/horde2test/htdocs/horde/imp/lib/IMP.php on line 167
[19-Feb-2003 21:06:37] PHP Warning:  fclose(): supplied argument is not a valid stream resource in /opt/horde2test/htdocs/horde/imp/lib/IMP.php on line 168


If I use the older horde/imp on the _same_ machine with the _same_ apache/php there is no problem the file is created.

And to be more funny: /tmp is a symlink to /var/tmp
If i change the line
$pfad="/tmp/ldapcache/".$buchstabe1."/".$buchstabe2;
to
$pfad="/var/tmp/ldapcache/".$buchstabe1."/".$buchstabe2;

everything works as expected.

And now I do not know what to do?

What can cause such strange effects?
To be honest I hesitate to go productional with such a system if I cannot be sure that its working as it should.

Yours Joerg


Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2003-02-19 22:01 UTC] sniper@php.net
Please try using this CVS snapshot:

  http://snaps.php.net/php4-STABLE-latest.tar.gz
 
For Windows:
 
  http://snaps.php.net/win32/php4-win32-STABLE-latest.zip


And are you setting open_basedir in httpd.conf??
As you can see, the setting seems to get reset at 
some point.

 [2003-02-20 01:55 UTC] Joerg dot Dieter dot Friedrich at uni-konstanz dot de
Yes, there is definitly no php_(admin_)value open_basedir in httpd.conf.

I'll try the snapshot as soon as I'm back in my office.

Yours Joerg
 [2003-02-21 12:48 UTC] Joerg dot Dieter dot Friedrich at uni-konstanz dot de
Hi!

I testet the snapshot php4-STABLE-200302211030
and the problem is still there.
 [2003-02-21 15:25 UTC] wez@php.net
Please try applying the patch posted in Bug number 21310
at 12 Feb 2:19pm CST by jflemer@php.net
 [2003-02-23 16:41 UTC] sniper@php.net
Please do not submit the same bug more than once. An existing
bug report already describes this very problem. Even if you feel
that your issue is somewhat different, the resolution is likely
to be the same. Because of this, we hope you add your comments
to the existing bug instead.

Thank you for your interest in PHP.


See bug #21310

(and add any comments there from now on)

 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Wed Apr 24 17:01:30 2024 UTC