|  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #63904 open_basedir is not respected for .user.ini files
Submitted: 2013-01-04 16:01 UTC Modified: 2021-07-12 17:23 UTC
From: lekensteyn at gmail dot com Assigned:
Status: Open Package: Safe Mode/open_basedir
PHP Version: 5.4.10 OS: Linux
Private report: No CVE-ID: None
View Add Comment Developer Edit
Anyone can comment on a bug. Have a simpler test case? Does it work for you on a different platform? Let us know!
Just going to say 'Me too!'? Don't clutter the database with that please — but make sure to vote on the bug!
Your email address:
Solve the problem:
46 + 11 = ?
Subscribe to this entry?

 [2013-01-04 16:01 UTC] lekensteyn at gmail dot com
(this bug possibly applies to the CGI SAPI too, but I have not checked that.)

In a default configuration for PHP-FPM, the use of .user.ini files is enabled. This feature allows you to put .user.ini interleaved with PHP files.

There is a possibility to bypass open_basedir restrictions by using symlinks. For a given open_basedir = /foo/, a symlink /foo/.user.ini -> /bar/php.ini can be used to read the configuration of /bar/php.ini.

It does not look like a feature, at first I wanted to have a .user.ini just outside the webroot (e.g. web/.user.ini with DOCUMENT_ROOT web/public_html), but having the symlink defeats the advantage of putting it outside the webroot for privacy. (ignoring WWW server abilities to restrict access). Therefore, it must be a bug that open_basedir is not respected for .user.ini files.


Add a Patch

Pull Requests

Add a Pull Request


AllCommentsChangesGit/SVN commitsRelated reports
 [2021-07-12 15:39 UTC]
-Type: Security +Type: Bug
 [2021-07-12 15:39 UTC]
open_basedir bypasses are not considered to be security issues;
cf. <>
and <>.
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Thu Feb 29 14:01:34 2024 UTC