php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Request #37754 There is no default for open_basedir could it be that DOCUMENT_ROOT be default?
Submitted: 2006-06-08 21:21 UTC Modified: 2021-05-20 11:21 UTC
Votes:8
Avg. Score:4.2 ± 1.4
Reproduced:4 of 6 (66.7%)
Same Version:3 (75.0%)
Same OS:3 (75.0%)
From: yurtesen at ispro dot net Assigned: cmb (profile)
Status: Wont fix Package: Safe Mode/open_basedir
PHP Version: 4.4.2 OS: FreeBSD
Private report: No CVE-ID: None
View Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
If you reported this bug, you can edit this bug over here.
(description)
Block user comment
Status: Assign to:
Package:
Bug Type:
Summary:
From: yurtesen at ispro dot net
New email:
PHP Version: OS:

 

 [2006-06-08 21:21 UTC] yurtesen at ispro dot net 
Description:
------------
There is no default for open_basedir(NULL). If there was a knob to turn on which would make DOCUMENT_ROOT to be the default then one could have open_basedir working for their current virtualhosts only by enabling the option.

I assume this is quite safe when used with safe_mode since safe_mode can disable the change of environment variables or PHP could read document root value from the vhost configuration.

I believe this would be trivial to implement and a very useful feature indeed.

Expected result:
----------------
I would like to be able to set open_basedir dynamicly without the need to set it per virtualhost seperately.

Actual result:
--------------
It is not possible to use any kind of variables in open_basedir setting so it is impossible to set it dynamicly.

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2016-12-30 23:45 UTC] cmb@php.net
-Package: Feature/Change Request +Package: Safe Mode/open_basedir
 [2021-05-20 11:21 UTC] cmb@php.net
-Status: Open +Status: Wont fix -Assigned To: +Assigned To: cmb
 [2021-05-20 11:21 UTC] cmb@php.net 
That would not necessarily work/make sense for some SAPIs.
Furthermore, open_basedir has the drawback that the realpath cache
is disabled, so enforcing a default would be controversial.

Anyhow, given that this ticket has been filed almost 15 years ago,
and no further discussion happend, I'm closing this as wontfix.
If anybody is still interested in having an open_basedir default,
please pursue the RFC process[1].

[1] <https://wiki.php.net/rfc/howto>
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved. 		Last updated: Sat Jul 12 02:01:35 2025 UTC