#17927 [Com]: open_basedir is not working

ID: 17927 Comment by: michael@moria.de Reported By: matt@haught.com Status: Open Bug Type: Apache2 related Operating System: FreeeBSD 4.4-RELEASE PHP Version: 4.3.0 New Comment: At first, I read in a couple places to use "php_value", which is wrong. "php_admin_value" is correct, but PHP 4.2.2 fails to parse it correctly without this patch: --- sapi/apache2filter/apache_config.c.orig 2002-07-28 23:58:24.000000000 +0200 +++ sapi/apache2filter/apache_config.c 2002-07-28 23:58:37.000000000 +0200 @@ -128,7 +128,7 @@ { AP_INIT_TAKE2("php_value", php_apache_value_handler, NULL, OR_OPTIONS, "PHP Value Modifier"), - AP_INIT_TAKE2("php_admin_value", php_apache_admin_value_handler, NULL, OR_NONE, + AP_INIT_TAKE2("php_admin_value", php_apache_admin_value_handler, NULL, OR_OPTIONS, "PHP Value Modifier"), {NULL} }; It does not look like php_admin_flag is implemented for apache 2. Previous Comments: ------------------------------------------------------------------------ [2002-06-26 19:49:43] matt@haught.com I tried it on 1 other Windows server, same result... ------------------------------------------------------------------------ [2002-06-26 19:41:37] matt@haught.com open_basedir is also not working correctly on WinXP w/apache2.0.39 and the latest snap as of this post. --Matt ------------------------------------------------------------------------ [2002-06-24 14:35:12] matt@haught.com I just tested this on FreeBSD 4.6-RELEASE and the problem is also occuring there. To test this i created a file in my /usr/local/www/data directory that has: <?php include (../matt.php); phpinfo(); ?> amd in /usr/local/www i created the file matt.php with just a echo of my name and some <br>'s. I then set the open_basedir in php.ini to /usr/local/www/data and tested it, and then just via php_admin_value, and then both. And in all cases i was allowed to include matt.php which is not in the set open_basedir. I also tried including /etc/passwd and was again successful. Could someone please try to do the same? I am using the latest snap as of this post. ------------------------------------------------------------------------ [2002-06-23 14:15:52] matt@haught.com Ok to make matters even more odd, one of my pages calls opendir(), and get open_basedir error "open_basedir restriction in effect. File is in wrong directory ", it seems to be working for opendir(), but not when opening the first page or its includes. I know it is probably a problem with apache2+freebsd. Is their anyone else having the same problem, or does anyone have any tests they want me to run? I know apache2 is low on the priority list, so don't sweat it. --Matt ------------------------------------------------------------------------ [2002-06-23 10:11:09] matt@haught.com I just updated to php4-200206230600, and it is still a no go. I have done a little more testing, I removed all the php_admin_* and php_* directives from httpd.conf, and I set the php.ini setting for open_basedir to /tmp (the pages are not there) so that it is the only place it is set. It shows up in phpinfo() as /tmp in both local and master, but it still does not work as I receive no errors when opening a page or including a page from elsewhere. It seems that the settings for open_basedir are being set, but just not acted on. ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at http://bugs.php.net/17927 -- Edit this bug report at http://bugs.php.net/?id=17927&edit=1