php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #43419 Using gzfile() with URL and open_basedir
Submitted: 2007-11-26 20:36 UTC Modified: 2021-05-20 16:35 UTC
Votes:3
Avg. Score:4.3 ± 0.9
Reproduced:2 of 3 (66.7%)
Same Version:2 (100.0%)
Same OS:2 (100.0%)
From: vinni10 at gmx dot net Assigned: cmb (profile)
Status: Not a bug Package: Safe Mode/open_basedir
PHP Version: 5.2.6 OS: Linux (Debian)
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If this is not your bug, you can add a comment by following this link.
If this is your bug, but you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: vinni10 at gmx dot net
New email:
PHP Version: OS:

 

 [2007-11-26 20:36 UTC] vinni10 at gmx dot net
Description:
------------
When you try to read an external file with gzfile() and open_basedir restriction you will get an warning that /tmp is not in allowed paths.

Reproduce code:
---------------
<?php
$url = "http://url/test.gz";

/** Try to use gzfile() with HTTP and open_basedir **/
$var1 = gzfile($url);

/** Try to use gzfile() with downloaded file and open_basedir **/
$filename = "dwltest.gz";
file_put_contents($filename, file_get_contents($url));
$var2 = gzfile($filename);
unlink($filename);

echo "<pre>";
echo "<b>remote gzfile:</b>\n";
var_dump($var1);
echo "\n\n<b>local gzfile:</b>\n";
var_dump($var2);
echo "</pre>";
?>

Expected result:
----------------
remote gzfile:
array(1) {
  [0]=>
  string(23) "This is a simple test!"
}

local gzfile:
array(1) {
  [0]=>
  string(23) "This is a simple test!"
}

Actual result:
--------------
Warning: gzfile() [function.gzfile]: open_basedir restriction in effect. File(/tmp) is not within the allowed path(s): (/var/www/) in /var/www/gzfile_test.php on line 8

Warning: gzfile(http://url/test.gz) [function.gzfile]: could not make seekable - http://url/test.gz in /var/www/gzfile_test.php on line 8

remote gzfile:
bool(false)

local gzfile:
array(1) {
  [0]=>
  string(23) "This is a simple test!"
}

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2007-11-27 12:58 UTC] jani@php.net
This is more general issue, anything trying to use /tmp causes this. (there are other reports about this too)
 [2020-12-21 15:01 UTC] sji at sj-i dot dev
Cannot reproduce this on PHP 7.4
 [2021-05-20 16:35 UTC] cmb@php.net
-Status: Open +Status: Not a bug -Assigned To: +Assigned To: cmb
 [2021-05-20 16:35 UTC] cmb@php.net
> [function.gzfile]: could not make seekable

That's the relevant error message.  In order to make the HTTP
wrapper seekable, the stream is copied to the temporary directory.
If this cannot be written to for whatever reason (in this case due
to open_basedir restriction), the operation fails.

This is, however, not a bug.  Add the tmp directory to
open_basedir, or don't use functionality which may require the tmp
directory.
 
PHP Copyright © 2001-2021 The PHP Group
All rights reserved.
Last updated: Sat Jul 24 10:01:24 2021 UTC