#19395 [NEW]: open_basedir (closing slash does not work)

From: benter@yippi-yeah.com Operating system: Linux 2.4.16-4GB (SuSE kernel) PHP version: 4.2.3 PHP Bug Type: PHP options/info functions Bug description: open_basedir (closing slash does not work) In http://www.php.net/manual/en/printwn/configuration.php#ini.open-basedir it says: When you want to restrict access to only the specified directory, end with a slash. For example: "open_basedir = /dir/incl/" We have three test webs: /home/www/www1 /home/www/www4 /home/www/www102 Each web has it's own virtual host and open_basedir set to it's directory: For www1 phpinfo() says: safe_mode: On open_basedir: /home/www/www1/ (<- closing slash!) With test.php in /home/www/www1/html/ <? $parent = dir('/home/www/www102/html'); ?> I get: Warning: SAFE MODE Restriction in effect. ... Changing it to read www4's dir: <? $parent = dir('/home/www/www4/html'); ?> I get: Warning: open_basedir restriction in effect. File is in wrong directory ... So, the closing slash does not prevent www1's scripts accessing www1* scripts via open_basedir. With safe_mode deactivated www1 could read www1*'s dirs but not www4,www5,www6... dirs. Either the documentation is wrong or the slash at the end is ignored? Regards, Jan-Hendrik Benter -- Edit bug report at http://bugs.php.net/?id=19395&edit=1 -- Try a CVS snapshot: http://bugs.php.net/fix.php?id=19395&r=trysnapshot Fixed in CVS: http://bugs.php.net/fix.php?id=19395&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=19395&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=19395&r=needtrace Try newer version: http://bugs.php.net/fix.php?id=19395&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=19395&r=support Expected behavior: http://bugs.php.net/fix.php?id=19395&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=19395&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=19395&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=19395&r=globals