Req #53263 [Com]: Allow realpath cache to function even with open_basedir enabled

Edit report at https://bugs.php.net/bug.php?id=53263&edit=1 ID: 53263 Comment by: retertertert at fgfgfg dot com Reported by: tomsommer@php.net Summary: Allow realpath cache to function even with open_basedir enabled Status: Wont fix Type: Feature/Change Request Package: Safe Mode/open_basedir Operating System: * PHP Version: 5.3.3 Block user comment: N Private report: N New Comment: > One script could, during its lifetime, create and > resolve a symlink to a path within open_basedir, > then redirect that symlink to a path outside it i wonder how it will do that with disable_functions="symlink" which is global and known at startup and with all exec&freinds also in disbale_functions Previous Comments: ------------------------------------------------------------------------ [2019-11-14 15:34:16] requinix@php.net @michael: It applies to one request as well as it does multiple requests. One script could, during its lifetime, create and resolve a symlink to a path within open_basedir, then redirect that symlink to a path outside it. In the interests of having one fewer open tickets regarding open_basedir performance, and since #52312 is still open, I'm going to wontfix this per @rasmus's comment. ------------------------------------------------------------------------ [2019-11-14 11:38:57] michael dot vorisek at email dot cz Is the cache issue related only when the PHP process is resused for multiple requests with different open_basedir values? If yes, an extra switch makes 100% sense. The security is 100% kept and realpath cache will be available which makes up too 10x the performace on Windows with file heavy scripts. ------------------------------------------------------------------------ [2010-11-08 17:44:30] rasmus@php.net I don't think the security problem is fixable. We have no way to prevent the contents behind a cache entry from changing which is the root of the security problem. And I don't see the point in open_basedir if you remove the security aspect. The less secure toggle is to simply turn off open_basedir. An open_basedir feature that doesn't actually guarantee that users can't open files outside of the specified base directory isn't useful. ------------------------------------------------------------------------ [2010-11-08 14:17:30] tomsommer@php.net Description: ------------ As described in bug #52312 - realpath cache is disabled when open_basedir is enabled. Would it be possible to either: 1) Fix the security problem related to having both enabled at the same time 2) Add a php.ini or ./configure toggle to enable both at the same time, overriding the security aspect in order to gain performance. Thanks ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=53263&edit=1