|
php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login |
[2017-02-26 15:02 UTC] nk dot hesam+php at gmail dot com
Description: ------------ very similar to Bug #41518 [https://bugs.php.net/bug.php?id=41518], but happening in a much narrower case. consider following file structure exists: - parent - folder1 - image2.jpg - file.txt with open_basedir enabled, consider one tries to perform file_exists($filename) with $filename within the permitted paths. three cases are presented: - $filename = 'path/to/parent/folder1/image.jpg' file does not exists but the containing folder (folder1) does. file_exists() returns false as expected. - $filename = 'path/to/parent/folder2/image.jpg' neither file nor it's containing folder (folder2) do not exist. file_exists() returns false as expected. - $filename = 'path/to/parent/file.txt/image.jpg' the target file (image.jpg) does not exist but there is a file named file.txt, in this case when file_exists() tries to look into file.txt (it assumes it's a folder) an open_basedir restriction warning arises. file_exists() still returns false. same thing happens with is_file and is_dir functions. I've checked it on PHP 5.6.30 and 7.0.12 and same thing happens on both versions. Test script: --------------- ini_set('open_basedir', 'path/to/parent'); file_exists('path/to/parent/folder1/image.jpg'); // returns false file_exists('path/to/parent/folder2/image.jpg'); // returns false file_exists('path/to/parent/file.txt/image.jpg'); // returns false and causes open_basedir warning Expected result: ---------------- all three cases should return false without warning. as the given $filename to file_exists() function is located under allowed paths. Actual result: -------------- the third function call results in following warning: Warning: file_exists(): open_basedir restriction in effect. PatchesPull RequestsHistoryAllCommentsChangesGit/SVN commits
|
|||||||||||||||||||||||||||
Copyright © 2001-2025 The PHP GroupAll rights reserved. |
Last updated: Sat Oct 25 13:00:01 2025 UTC |
and what does the "and many others" tell you? for me it tells it's a real life problem for many developers, especially when someone dvelops on a sunshine environment without open_basedir and finally on a server with open_basedir opportunitic checks like file_exists('../something'); starting to flood logs for no good reason