Bug #13207: open_basedir not restricting file access properly

From: jedi@tstonramp.com Operating system: NT 4.0 PHP version: 4.0.6 PHP Bug Type: IIS related Bug description: open_basedir not restricting file access properly Script is as follows: mkdir("/test",0700); phpinfo(); I'm running IIS 4.0 on NT 4.0 SP6. This code is running in my web servers default web site. I AM doing Virtual Web hosting using Host Header method, not multiple IPs. The anonymous web user for the virtual web server in question let's say is called: anon When the script is run and anon is *denied* permissions to C:\ the following error is generated: Warning: MkDir failed (Permission denied) in C:\InetPub\wwwroot\php\test.php on line 2 and PHPInfo displays open_basedir as being: C:\inetpub (This is good.) When I go in and grant user anon "Change" privileges to C:\ (I do NOT apply to all subdirectories) and re-run the script then: I get NO error message and __THE DIRECTORY IS CREATED__ as C:\test This is bad. VERY bad. I need to be able to rely on open_basedir preventing __ANY__ file access outside of C:\inetpub. -- Edit bug report at: http://bugs.php.net/?id=13207&edit=1