|  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #43419 Using gzfile() with URL and open_basedir
Submitted: 2007-11-26 20:36 UTC Modified: 2021-05-20 16:35 UTC
Avg. Score:4.3 ± 0.9
Reproduced:2 of 3 (66.7%)
Same Version:2 (100.0%)
Same OS:2 (100.0%)
From: vinni10 at gmx dot net Assigned: cmb (profile)
Status: Not a bug Package: Safe Mode/open_basedir
PHP Version: 5.2.6 OS: Linux (Debian)
Private report: No CVE-ID: None
 [2007-11-26 20:36 UTC] vinni10 at gmx dot net
When you try to read an external file with gzfile() and open_basedir restriction you will get an warning that /tmp is not in allowed paths.

Reproduce code:
$url = "http://url/test.gz";

/** Try to use gzfile() with HTTP and open_basedir **/
$var1 = gzfile($url);

/** Try to use gzfile() with downloaded file and open_basedir **/
$filename = "dwltest.gz";
file_put_contents($filename, file_get_contents($url));
$var2 = gzfile($filename);

echo "<pre>";
echo "<b>remote gzfile:</b>\n";
echo "\n\n<b>local gzfile:</b>\n";
echo "</pre>";

Expected result:
remote gzfile:
array(1) {
  string(23) "This is a simple test!"

local gzfile:
array(1) {
  string(23) "This is a simple test!"

Actual result:
Warning: gzfile() [function.gzfile]: open_basedir restriction in effect. File(/tmp) is not within the allowed path(s): (/var/www/) in /var/www/gzfile_test.php on line 8

Warning: gzfile(http://url/test.gz) [function.gzfile]: could not make seekable - http://url/test.gz in /var/www/gzfile_test.php on line 8

remote gzfile:

local gzfile:
array(1) {
  string(23) "This is a simple test!"


Add a Patch

Pull Requests

Add a Pull Request


AllCommentsChangesGit/SVN commitsRelated reports
 [2007-11-27 12:58 UTC]
This is more general issue, anything trying to use /tmp causes this. (there are other reports about this too)
 [2020-12-21 15:01 UTC] sji at sj-i dot dev
Cannot reproduce this on PHP 7.4
 [2021-05-20 16:35 UTC]
-Status: Open +Status: Not a bug -Assigned To: +Assigned To: cmb
 [2021-05-20 16:35 UTC]
> [function.gzfile]: could not make seekable

That's the relevant error message.  In order to make the HTTP
wrapper seekable, the stream is copied to the temporary directory.
If this cannot be written to for whatever reason (in this case due
to open_basedir restriction), the operation fails.

This is, however, not a bug.  Add the tmp directory to
open_basedir, or don't use functionality which may require the tmp
PHP Copyright © 2001-2021 The PHP Group
All rights reserved.
Last updated: Sun Sep 26 10:03:36 2021 UTC