#50488 [NEW]: global setting for open_basedir in combination with virtual hosts needed

From: lars dot plessmann at gmx dot de Operating system: OpenSUSE 2.6.18-028stab064.7 PHP version: 5.3.1 PHP Bug Type: Safe Mode/open_basedir Bug description: global setting for open_basedir in combination with virtual hosts needed Description: ------------ This is more a feature request for PHP. If you are running apache with vhosts support, you need to set the open_basedir for each vhost for security reasons. The problem is, you cannot set a global open_basedir setting which is valid all time for any vhost (in the php.ini e.g.)! If the open_basdir setting is new set in a httpd.conf vhost-section, the global value will be overwritten. In this case you have to set the "global" setting in the httpd.conf vhost-section again. This is very much administration overhead! And the very most problem is, the httpd.conf vhost sections are often automatically generated (think about PLESK or other webhosting tools). A new option called something like "global_open_basedir" would be very appreciated for directories like /Tmp-Dir /Path-To-Pear-Installation etc. Reproduce code: --------------- *** php.ini *** ; open_basedir, if set, limits all file operations to the defined directory ; and below. This directive makes most sense if used in a per-directory ; or per-virtualhost web server configuration file. This directive is ; *NOT* affected by whether Safe Mode is turned On or Off. open_basedir = "/tmp:/usr/share/php5/PEAR" **************** *** httpd.conf *** <VirtualHost xx.xx.xx.xx:80> [...] php_admin_flag engine on php_admin_flag safe_mode off php_admin_value open_basedir "/srv/www/vhosts/domain1.tld/httpdocs:/tmp:/usr/share/php5/PEAR" [...] </VirtualHost> <VirtualHost xx.xx.xx.xx:80> [...] php_admin_flag engine on php_admin_flag safe_mode off php_admin_value open_basedir "/srv/www/vhosts/domain2.tld/httpdocs:/tmp:/usr/share/php5/PEAR" [...] </VirtualHost> [some other 50 vhosts...] **************** Expected result: ---------------- *** php.ini *** ; open_basedir, if set, limits all file operations to the defined directory ; and below. This directive makes most sense if used in a per-directory ; or per-virtualhost web server configuration file. This directive is ; *NOT* affected by whether Safe Mode is turned On or Off. ; ;open_basedir = ; valid for any vhost if not overwritten global_open_basedir = "/tmp:/usr/share/php5/PEAR" **************** *** httpd.conf *** <VirtualHost xx.xx.xx.xx:80> [...] php_admin_flag engine on php_admin_flag safe_mode off php_admin_value open_basedir "/srv/www/vhosts/domain1.tld/httpdocs" [...] </VirtualHost> <VirtualHost xx.xx.xx.xx:80> [...] php_admin_flag engine on php_admin_flag safe_mode off php_admin_value open_basedir "/srv/www/vhosts/domain2.tld/httpdocs" [...] </VirtualHost> [some other 50 vhosts...] **************** Actual result: -------------- at the moment you can set the open_basedir configuration in php.ini but you cannot extend it with further directories in the vhost-section part. So, you do automatically overwrite the open_basedir setting in the vhost-section part which is not very handy for administrative tasks. A sepparate global_open_basedir setting would solve the problem and offer more control and less work for system administrators. -- Edit bug report at http://bugs.php.net/?id=50488&edit=1 -- Try a snapshot (PHP 5.2): http://bugs.php.net/fix.php?id=50488&r=trysnapshot52 Try a snapshot (PHP 5.3): http://bugs.php.net/fix.php?id=50488&r=trysnapshot53 Try a snapshot (PHP 6.0): http://bugs.php.net/fix.php?id=50488&r=trysnapshot60 Fixed in SVN: http://bugs.php.net/fix.php?id=50488&r=fixed Fixed in SVN and need be documented: http://bugs.php.net/fix.php?id=50488&r=needdocs Fixed in release: http://bugs.php.net/fix.php?id=50488&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=50488&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=50488&r=needscript Try newer version: http://bugs.php.net/fix.php?id=50488&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=50488&r=support Expected behavior: http://bugs.php.net/fix.php?id=50488&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=50488&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=50488&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=50488&r=globals PHP 4 support discontinued: http://bugs.php.net/fix.php?id=50488&r=php4 Daylight Savings: http://bugs.php.net/fix.php?id=50488&r=dst IIS Stability: http://bugs.php.net/fix.php?id=50488&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=50488&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=50488&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=50488&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=50488&r=mysqlcfg