#17536 [Opn->Fbk]: safe_mode_include_dir does not work properly with symbolic links.

ID: 17536 Updated by: iliaa@php.net Reported By: mburger@netbeyond.de -Status: Open +Status: Feedback Bug Type: Scripting Engine problem Operating System: Linux (SuSE) PHP Version: 4.2.1 New Comment: Please try using this CVS snapshot: http://snaps.php.net/php4-latest.tar.gz For Windows: http://snaps.php.net/win32/php4-win32-latest.zip Previous Comments: ------------------------------------------------------------------------ [2002-05-30 20:17:43] mburger@netbeyond.de Hello, I think safe_mode_include_dir does not work properly with symbolic links. Here my configuration: <VirtualHost 134.96.x.y> DocumentRoot /kunden/hosting/server/doma.in/sub/htdocs ServerName sub.doma.in <IfModule mod_php4.c> php_admin_value safe_mode 1 php_admin_value safe_mode_exec_dir /usr/bin php_admin_value safe_mode_include_dir /kunden/hosting/server/doma.in/sub php_admin_value open_basedir /kunden/hosting/server/doma.in/sub php_admin_value upload_tmp_dir /kunden/hosting/server/doma.in/sub/tmp php_admin_value include_path .:/kunden/hosting/server/doma.in/sub/lib_php php_admin_value error_reporting 2023 </IfModule> </VirtualHost> I copied /usr/local/lib/php/. to /kunden/hosting/server/doma.in/sub/lib_php/ (PEAR). Everthing in .../sub/lib_php/. is owned by root.root, the remaining files and dirs in .../sub/ by vs1.www If I try to include 'System.php' I get this error: Warning: SAFE MODE Restriction in effect. The script whose uid is 504 is not allowed to access /kunden/hosting/server/doma.in/sub/lib_php/System.php owned by uid 0 in /var/www/doma.in/sub/htdocs/index.php on line 9 You should know there is a symbolic link: /kunden/hosting/server -> /var/www If I change the line with safe_mode_include_dir as following php_admin_value safe_mode_include_dir /var/www/doma.in/sub the include statements works as expected. Regards, Martin ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=17536&edit=1