Bug #62606 [NEW]: PHP as fastCgi traverses directory up to the root / permission issues

From: thomas dot hoffmann at speed4trade dot com Operating system: Win2008 R2 PHP version: 5.3.14 Package: Performance problem Bug Type: Bug Bug description:PHP as fastCgi traverses directory up to the root / permission issues Description: ------------ I use PHP via FastCGI on Win2008R2 IIS 7.5 Via "Process Monitor" I can see that the first time I access a php page, the PHP-CGI.exe opens the php-file and then walks up the directory tree up to the root. It traverses/opens all directories till it reaches the Root-Folder (e.g. d:\) This causes a huge performance impact when the PHP process doesnt have permissions to travers the root-folder (or a folder outside the webroot). Starting a webpage with redaxo e.g. lasts about 50 seconds instead of 1 or 2 seconds as many file includes/(accesses take place. user_ini.filename is disabled (but PHP should anyway stop at the webroot). safe_mode and open_basedir are off / not used Test script: --------------- - Create test.php with just one echo line - Use PHP-CGI.exe via FastCGI on Windows 2008R2 - Open "Process monitor" and apply filter for php-cgi.exe - Open test.php via browser - See in process monitor how the process accesses not only test.php but also walks up the directory tree and traverses all parent folders till it reaches the root - To test the performance impact you can delete the folder permission on the parent folders of the webroot and open the page several times (e.g. via curl and a loop) Expected result: ---------------- PHP-cgi.exe should not travers folders outside the webroot. Actual result: -------------- PHP-cgi.exe opens/traverses all parent folders of the webroot up to the root. -- Edit bug report at https://bugs.php.net/bug.php?id=62606&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=62606&r=trysnapshot54 Try a snapshot (PHP 5.3): https://bugs.php.net/fix.php?id=62606&r=trysnapshot53 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=62606&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=62606&r=fixed Fixed in SVN and need be documented: https://bugs.php.net/fix.php?id=62606&r=needdocs Fixed in release: https://bugs.php.net/fix.php?id=62606&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=62606&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=62606&r=needscript Try newer version: https://bugs.php.net/fix.php?id=62606&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=62606&r=support Expected behavior: https://bugs.php.net/fix.php?id=62606&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=62606&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=62606&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=62606&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=62606&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=62606&r=dst IIS Stability: https://bugs.php.net/fix.php?id=62606&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=62606&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=62606&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=62606&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=62606&r=mysqlcfg