Bug #79083 [Com]: 7.4.1 does not follow symlinks outside of documentroot while 7.4.0 does

Edit report at https://bugs.php.net/bug.php?id=79083&edit=1 ID: 79083 Comment by: calimeroteknik at free dot fr Reported by: calimeroteknik at free dot fr Summary: 7.4.1 does not follow symlinks outside of documentroot while 7.4.0 does Status: Feedback Type: Bug Package: FPM related Operating System: Linux PHP Version: 7.4.1 Block user comment: N Private report: N New Comment: Oh wait. I misunderstood. Adding %f to the log format, here are the results: access.format = "%R - %u %t \"%m %r\" %s \"%f\"" The log: - - 21/Jan/2020:19:06:17 +0100 "GET /phpinfo.php" 200 "/srv/http/phpinfo.php" - - 21/Jan/2020:19:06:29 +0100 "GET /symlink.php" 200 "/srv/http/symlink.php" - - 21/Jan/2020:19:06:23 +0100 "GET /symlink2.php" 404 "-" The webserver does not resolve the symlink, but we get "-" logged for %f. Previous Comments: ------------------------------------------------------------------------ [2020-01-21 17:59:08] calimeroteknik at free dot fr Here is my test setup: -rw-r--r-- /srv/http/phpinfo.php lrwxrwxrwx /srv/http/symlink.php -> phpinfo.php -rw-r--r-- /tmp/phpinfo.php lrwxrwxrwx /srv/http/symlink2.php -> /tmp/phpinfo.php Here is what access.log produces for the corresponding FPM pool: - - 21/Jan/2020:18:46:42 +0100 "GET /phpinfo.php" 200 - - 21/Jan/2020:18:46:48 +0100 "GET /symlink.php" 200 - - 21/Jan/2020:18:52:20 +0100 "GET /symlink2.php" 404 Clearly, the webserver does not resolve the symlink, and php-fpm chooses to do so only when the target is within the document root, which is known to php-fpm since we see in the log that it has the query string. ------------------------------------------------------------------------ [2020-01-16 08:55:47] sjon@php.net fpm has no notion of a "DocumentRoot" - it gets passed the absolute path from the webserver. It is therefore very likely your webserver resolves the symlink, not fpm. You can verify this by enabling the fpm access.log and make sure it includes %f (the absolute script path). If this indicates an issue in PHP itself, please update this bug with relevant information ------------------------------------------------------------------------ [2020-01-08 18:08:26] calimeroteknik at free dot fr Description: ------------ When I have a symbolic link in the path to a PHP file (could be a parent directory), which points outside of the DocumentRoot (apparently, this is what triggers the behavior) : - with php-fpm 7.4.0 it works, the file renders. - with php-fpm 7.4.1 I get the message "File not found." as the HTTP response, and "Primary script unknown" in the webserver's error log. open_basedir was unset in this test. Setting it to "/my/document/root:/path/to/symlink/destination" does not seem to change the results. This was tested using php-fpm with apache 2.4.41 (event MPM) with no change in both cases. Test script: --------------- <?php phpinfo(); ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=79083&edit=1