Bug #53514 [Opn]: open_basedir broken in PHP 5.2.15, denies access to all files

Edit report at http://bugs.php.net/bug.php?id=53514&edit=1 ID: 53514 Updated by: tomsommer@php.net Reported by: tomsommer@php.net Summary: open_basedir broken in PHP 5.2.15, denies access to all files Status: Open Type: Bug Package: Safe Mode/open_basedir Operating System: Linux PHP Version: 5.2.15 Block user comment: N Private report: N New Comment: Cannot reproduce in PHP 5.3.4, seems to only affect 5.2.15 Previous Comments: ------------------------------------------------------------------------ [2010-12-10 09:55:45] tomsommer@php.net Only tested in PHP 5.2.15, downloaded an hour ago # /usr/local/src/php-5.2.15/sapi/cli/php -d open_basedir=/root/ -r "echo fopen('/root/a.php', 'r');" Warning: fopen(): open_basedir restriction in effect. File(/root/a.php) is not within the allowed path(s): (/root/) in Command line code on line 1 Warning: fopen(/root/a.php): failed to open stream: Operation not permitted in Command line code on line 1 ------------------------------------------------------------------------ [2010-12-10 09:50:20] cataphract@php.net I can't reproduce this with: /home/glopes/php/php5.3/bin/php -d open_basedir=/home/glopes/ -r "echo fopen('a.php', 'r');" Are you sure you're not using RC1? ------------------------------------------------------------------------ [2010-12-10 09:33:20] cataphract@php.net See also http://www.mail-archive.com/debian-bugs-dist@lists.debian.org/msg847440.html ------------------------------------------------------------------------ [2010-12-10 09:26:02] tomsommer@php.net The commit that presumably broke it: http://svn.php.net/viewvc/php/php-src/trunk/main/fopen_wrappers.c?r1=303824&r2=303823&pathrev=303824 ------------------------------------------------------------------------ [2010-12-10 09:24:39] tomsommer@php.net Description: ------------ The fix for CVE-2010-3436 broke open_basedir Might also affect PHP 5.3.4 consider php_admin_value open_basedir "/var/www/www.example.dk/:/var/www/tmp/:/usr/local/bin/safe/" The DocumentRoot of the site is "/var/www/www.example.dk/www/" Opening /var/www/www.example.dk/www/index.php (http://example.dk/index.php) triggers: Warning: Unknown: open_basedir restriction in effect. File(/var/www/www.example.dk/www/index.php) is not within the allowed path(s): (/var/www/www.example.dk/:/var/www/tmp/:/usr/local/bin/safe/) in Unknown on line 0 Warning: Unknown: failed to open stream: Operation not permitted in Unknown on line 0 Warning: Unknown: open_basedir restriction in effect. File(/var/www/www.example.dk/www/index.php) is not within the allowed path(s): (/var/www/www.example.dk/:/var/www/tmp/:/usr/local/bin/safe/) in Unknown on line 0 Warning: Unknown: failed to open stream: Operation not permitted in Unknown on line 0 Fatal error: Unknown: Failed opening required '/var/www/www.example.dk/www/index.php' (include_path='.:/usr/local/lib/php') in Unknown on line 0 ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/bug.php?id=53514&edit=1