Monday, 20 June 2016

security - How can I relax PHP's open_basedir restriction?




open_basedir limits the files that can be opened by PHP within a directory-tree.



I am storing several class libraries and configuration files outside of my web root directory. This way the web server does not make them publicly accessible. However when I try to include them from my application I get an open_basedir restriction error like this:




Warning: realpath()
[function.realpath]: open_basedir
restriction in effect.
File(/var/www/vhosts/domain.tld/zend/application)

is not within the allowed path(s):
(/var/www/vhosts/domain.tld/httpdocs:/tmp)
in
/var/www/vhosts/domain.tld/httpdocs/index.php
on line 5




My web root is here:



/var/www/vhosts/domain.tld/httpdocs



My libraries and configuration directory are here:



/var/www/vhosts/domain.tld/zend


What would be the best workaround to relax the open_basedir restriction so that the the directory tree under the domain folder becomes available to my application? I have a number of domains that I want to do this with, and I'm also obviously wary of creating security vulnerabilities.



Note: I am using CentOS, Apache, Plesk, and I have root ssh access to the server. And though this doesn't apply to Zend Framework directly, I am using it in this instance. So here is the inclusion from Zend's bootstrap:




define('APPLICATION_PATH', realpath(dirname(__FILE__) . '/../zend/application/'));
set_include_path(APPLICATION_PATH . '/../zend/library' . PATH_SEPARATOR . get_include_path());

Answer



You can also do this easily on a per-directory basis using the Apache (assuming this is your web server) configuration file (e.g. httpd.conf)




php_admin_value open_basedir "/var/www/vhosts/domain.tld/httpdocs:/var/www/vhosts/domain.tld/zend"




you can also completely remove the restriction with




php_admin_value open_basedir none


No comments:

Post a Comment

c++ - Does curly brackets matter for empty constructor?

Those brackets declare an empty, inline constructor. In that case, with them, the constructor does exist, it merely does nothing more than t...