php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Doc Bug #81042 open_basedir directories must exist
Submitted: 2021-05-14 23:35 UTC Modified: 2021-05-20 13:20 UTC
Votes:1
Avg. Score:4.0 ± 0.0
Reproduced:1 of 1 (100.0%)
Same Version:0 (0.0%)
Same OS:1 (100.0%)
From: bugs-php dot a2 at x25 dot pl Assigned:
Status: Re-Opened Package: *Directory/Filesystem functions
PHP Version: 7.4.19 OS:
Private report: No CVE-ID: None
 [2021-05-14 23:35 UTC] bugs-php dot a2 at x25 dot pl
Description:
------------
open_basedir does not work as it should:

Test script:
---------------
<?
ini_set("open_basedir","/home/naox/public_html/test");
is_dir("/home/naox/public_html/test");



Actual result:
--------------
Warning: is_dir(): open_basedir restriction in effect. File(/home/naox/public_html/test) is not within the allowed path(s): (/home/naox/public_html/test/) in /home/naox/public_html/a.php on line 3


Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2021-05-15 01:52 UTC] requinix@php.net
-Status: Open +Status: Feedback
 [2021-05-15 01:52 UTC] requinix@php.net
Does public_html/test exist?
 [2021-05-15 09:03 UTC] bugs-php dot a2 at x25 dot pl
-Status: Feedback +Status: Open
 [2021-05-15 09:03 UTC] bugs-php dot a2 at x25 dot pl
No, it does not exist but it should not matter.
 [2021-05-15 18:57 UTC] requinix@php.net
-Summary: open_basedir does not work as it should +Summary: open_basedir does not work as it should because of open_basedir -Status: Open +Status: Duplicate
 [2021-05-15 18:57 UTC] requinix@php.net
Duplicate of bug #52065

The issue is not open_basedir but that the functionality supporting is_dir() reports that the path does not exist, and the reason for that is assumed to be an open_basedir restriction. If public_html/test existed then you would not get this warning.
 [2021-05-18 18:08 UTC] bugs-php dot a2 at x25 dot pl
And how does it make not open_basedir problem? You are saying that I can't check if file/dir exists because it might not exist.

Then how about mkdir()? or file_exists() or is_file()? mkdir() cant create directory because it also does not exist? 

cat a.php
<?
ini_set("open_basedir","/home/naox/public_html/test");
mkdir("/home/naox/public_html/test");

php a.php

Warning: mkdir(): open_basedir restriction in effect. File(/home/naox/public_html/test) is not within the allowed path(s): (/home/naox/public_html/test) in /home/naox/public_html/naox.vipserv.org/a.php on line 3
 [2021-05-18 19:56 UTC] requinix@php.net
-Summary: open_basedir does not work as it should because of open_basedir +Summary: is_dir does not work as it should because of open_basedir
 [2021-05-18 19:56 UTC] requinix@php.net
> And how does it make not open_basedir problem? You are saying that I can't check
> if file/dir exists because it might not exist.

I'll try again.

open_basedir is not the problem. It works correctly. What does *not* work correctly is what PHP does when a file or directory does not exist.

if (path_exists_and_is_inside_open_basedir($path)) {
  // (A) good: exists
} else {
  if (open_basedir_is_enabled()) {
    // (B) bad: "open_basedir restriction in effect"
    // what if $path does not exist and is *inside* open_basedir!
  } else {
    // (C) good: does not exist
  }
}
 [2021-05-20 10:50 UTC] cmb@php.net
-Summary: is_dir does not work as it should because of open_basedir +Summary: open_basedir directories must exist -Status: Duplicate +Status: Re-Opened -Type: Bug +Type: Documentation Problem
 [2021-05-20 10:50 UTC] cmb@php.net
It seems to me this issue is slightly different from bug #52065.
In this case, I'd say this is a documentation issue, namely that
it is not explicitly documented that the directories set in
open_basedir must exist.
 [2021-05-20 10:56 UTC] rtrtrtrtrt at dfdfdfdf dot dfd
> open_basedir is not the problem
> It works correctly

obviosuly

> What does *not* work correctly is what PHP does when a 
> file or directory does not exist

and why don't that get fixed given that this issue exists at least for 15 years now?
 [2021-05-20 10:58 UTC] rtrtrtrtrt at dfdfdfdf dot dfd
> open_basedir restriction in effect. File(/home/naox/public_html/test) 
> is not within the allowed path(s): (/home/naox/public_html/test/)

seriously:

A: /home/naox/public_html/test
B: /home/naox/public_html/test/

A is pretty clear within B and you could check that and shut up
 [2021-05-20 13:20 UTC] cmb@php.net
Why would you want to specify a non existent directory as
open_basedir in the first place?
 [2021-07-01 13:13 UTC] rtrtrtrtrt at dfdfdfdf dot dfd
congratulations, with 7.4.21 is_file() starts with the same idiotic behavior

AUTOTEST ERROR-HANDLER: 'code: 2' 'msg: is_file(): open_basedir restriction in effect. File(/rte/../formate/formate.css) is not within the allowed path(s): (:/usr/share/php:/usr:/rpmbuild/PHP-PGO
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Thu Nov 21 13:01:29 2024 UTC