Bug #13207 Updated: open_basedir not restricting file access properly

ID: 13207 User updated by: jedi@tstonramp.com Reported By: jedi@tstonramp.com Status: Open Bug Type: IIS related Operating System: NT 4.0 PHP Version: 4.0.6 New Comment: Unless there is some other configuration I'm not aware of, I mentioned in the bug report that I have open_basedir enabled in that it says C:\inetpub as my open_basedir value when I do phpinfo() If there's something wrong with the path format, I guess I could understand that, although I've seen other Win-style path formats in phpinfo that take the same format. Previous Comments: ------------------------------------------------------------------------ [2001-09-07 21:25:52] rasmus@php.net You don't have open_basedir enabled. The error message from an open_basedir restriction is not "permission denied". Does your phpinfo() output tell you that open_basedir is in effect? ------------------------------------------------------------------------ [2001-09-07 19:09:40] jedi@tstonramp.com Script is as follows: mkdir("/test",0700); phpinfo(); I'm running IIS 4.0 on NT 4.0 SP6. This code is running in my web servers default web site. I AM doing Virtual Web hosting using Host Header method, not multiple IPs. The anonymous web user for the virtual web server in question let's say is called: anon When the script is run and anon is *denied* permissions to C:\ the following error is generated: Warning: MkDir failed (Permission denied) in C:\InetPub\wwwroot\php\test.php on line 2 and PHPInfo displays open_basedir as being: C:\inetpub (This is good.) When I go in and grant user anon "Change" privileges to C:\ (I do NOT apply to all subdirectories) and re-run the script then: I get NO error message and __THE DIRECTORY IS CREATED__ as C:\test This is bad. VERY bad. I need to be able to rely on open_basedir preventing __ANY__ file access outside of C:\inetpub. ------------------------------------------------------------------------ Edit this bug report at http://bugs.php.net/?id=13207&edit=1