#17927 [Opn->Fbk]: open_basedir is not working

ID: 17927 Updated by: iliaa@php.net Reported By: matt@haught.com -Status: Open +Status: Feedback Bug Type: Apache2 related Operating System: FreeeBSD 4.4-RELEASE PHP Version: 4.3.0 New Comment: Please try using this CVS snapshot: http://snaps.php.net/php4-latest.tar.gz For Windows: http://snaps.php.net/win32/php4-win32-latest.zip Previous Comments: ------------------------------------------------------------------------ [2002-07-28 18:21:20] michael@moria.de At first, I read in a couple places to use "php_value", which is wrong. "php_admin_value" is correct, but PHP 4.2.2 fails to parse it correctly without this patch: --- sapi/apache2filter/apache_config.c.orig 2002-07-28 23:58:24.000000000 +0200 +++ sapi/apache2filter/apache_config.c 2002-07-28 23:58:37.000000000 +0200 @@ -128,7 +128,7 @@ { AP_INIT_TAKE2("php_value", php_apache_value_handler, NULL, OR_OPTIONS, "PHP Value Modifier"), - AP_INIT_TAKE2("php_admin_value", php_apache_admin_value_handler, NULL, OR_NONE, + AP_INIT_TAKE2("php_admin_value", php_apache_admin_value_handler, NULL, OR_OPTIONS, "PHP Value Modifier"), {NULL} }; It does not look like php_admin_flag is implemented for apache 2. ------------------------------------------------------------------------ [2002-06-26 19:49:43] matt@haught.com I tried it on 1 other Windows server, same result... ------------------------------------------------------------------------ [2002-06-26 19:41:37] matt@haught.com open_basedir is also not working correctly on WinXP w/apache2.0.39 and the latest snap as of this post. --Matt ------------------------------------------------------------------------ [2002-06-24 14:35:12] matt@haught.com I just tested this on FreeBSD 4.6-RELEASE and the problem is also occuring there. To test this i created a file in my /usr/local/www/data directory that has: <?php include (../matt.php); phpinfo(); ?> amd in /usr/local/www i created the file matt.php with just a echo of my name and some <br>'s. I then set the open_basedir in php.ini to /usr/local/www/data and tested it, and then just via php_admin_value, and then both. And in all cases i was allowed to include matt.php which is not in the set open_basedir. I also tried including /etc/passwd and was again successful. Could someone please try to do the same? I am using the latest snap as of this post. ------------------------------------------------------------------------ [2002-06-23 14:15:52] matt@haught.com Ok to make matters even more odd, one of my pages calls opendir(), and get open_basedir error "open_basedir restriction in effect. File is in wrong directory ", it seems to be working for opendir(), but not when opening the first page or its includes. I know it is probably a problem with apache2+freebsd. Is their anyone else having the same problem, or does anyone have any tests they want me to run? I know apache2 is low on the priority list, so don't sweat it. --Matt ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at http://bugs.php.net/17927 -- Edit this bug report at http://bugs.php.net/?id=17927&edit=1