#37556 [NEW]: file_exists does not properly resolve symlinks before applying open_basedir

From: phpdotnet at ericmarques dot com Operating system: FreeBSD 5.4 PHP version: 5.1.4 PHP Bug Type: Safe Mode/open_basedir Bug description: file_exists does not properly resolve symlinks before applying open_basedir Description: ------------ file_exists does not properly resolve symlinks before applying open_basedir on "include" scripts. in my situation /home is a symlink to /data/home open_basedir is set to /home/ericmarq/ apache documentroot is set to /home/ericmarq/public_html Server running cPanel, apache 1.3 This did not happen in php 4.4.2, only happened after upgrade to 5.1.2 Reproduce code: --------------- -- test1.php -- <?php include("test2.php"); ?> -- test2.php -- <?php if (!file_exists("/home/ericmarq/public_html/SUBDIR/does.not.exist.html")){ print "no"; } ?> Expected result: ---------------- no Actual result: -------------- Warning: file_exists() [function.file-exists]: open_basedir restriction in effect. File(/home/ericmarq/public_html/SUBDIR/does.not.exist.html) is not within the allowed path(s): (/home/ericmarq/) in /data/home/ericmarq/public_html/test2.php on line 2 no -- Edit bug report at http://bugs.php.net/?id=37556&edit=1 -- Try a CVS snapshot (PHP 4.4): http://bugs.php.net/fix.php?id=37556&r=trysnapshot44 Try a CVS snapshot (PHP 5.2): http://bugs.php.net/fix.php?id=37556&r=trysnapshot52 Try a CVS snapshot (PHP 6.0): http://bugs.php.net/fix.php?id=37556&r=trysnapshot60 Fixed in CVS: http://bugs.php.net/fix.php?id=37556&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=37556&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=37556&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=37556&r=needscript Try newer version: http://bugs.php.net/fix.php?id=37556&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=37556&r=support Expected behavior: http://bugs.php.net/fix.php?id=37556&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=37556&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=37556&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=37556&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=37556&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=37556&r=dst IIS Stability: http://bugs.php.net/fix.php?id=37556&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=37556&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=37556&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=37556&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=37556&r=mysqlcfg