22

open_basedir limits the files that can be opened by PHP within a directory-tree.

I am storing several class libraries and configuration files outside of my web root directory. This way the web server does not make them publicly accessible. However when I try to include them from my application I get an open_basedir restriction error like this:

Warning: realpath() [function.realpath]: open_basedir restriction in effect. File(/var/www/vhosts/domain.tld/zend/application) is not within the allowed path(s): (/var/www/vhosts/domain.tld/httpdocs:/tmp) in /var/www/vhosts/domain.tld/httpdocs/index.php on line 5

My web root is here:

/var/www/vhosts/domain.tld/httpdocs

My libraries and configuration directory are here:

/var/www/vhosts/domain.tld/zend

What would be the best workaround to relax the open_basedir restriction so that the the directory tree under the domain folder becomes available to my application? I have a number of domains that I want to do this with, and I'm also obviously wary of creating security vulnerabilities.

Note: I am using CentOS, Apache, Plesk, and I have root ssh access to the server. And though this doesn't apply to Zend Framework directly, I am using it in this instance. So here is the inclusion from Zend's bootstrap:

define('APPLICATION_PATH', realpath(dirname(__FILE__) . '/../zend/application/'));
set_include_path(APPLICATION_PATH . '/../zend/library' . PATH_SEPARATOR . get_include_path());
0

3 Answers 3

21

You can also do this easily on a per-directory basis using the Apache (assuming this is your web server) configuration file (e.g. httpd.conf)

<Directory /var/www/vhosts/domain.tld/httpdocs>
php_admin_value open_basedir "/var/www/vhosts/domain.tld/httpdocs:/var/www/vhosts/domain.tld/zend"
</Directory>

you can also completely remove the restriction with

<Directory /var/www/vhosts/domain.tld/httpdocs>
php_admin_value open_basedir none
</Directory>
4
  • 6
    If the op is running plesk he'll need to be slightly more special than that: toosweettobesour.com/2008/02/02/plesk-open_basedir-workaround
    – dcousineau
    Oct 21, 2008 at 22:53
  • tom: Wouldn't removing the restriction entirely create a security vulnerability? dcousineau: thanks!
    – blee
    Oct 22, 2008 at 0:09
  • Brian: You would be only removing the restriction for php files being run from /var/www/vhosts/domain.tld/httpdocs , but yes the first option is better
    – Tom Haigh
    Oct 22, 2008 at 8:16
  • php_admin_value open_basedir none solved my problem. Thanks Apr 17, 2019 at 4:49
2

add the paths you need to access to (/var/www/vhosts/domain.tld/zend) to your open_basedir directive (you can specify several paths using the path separator ':' or ';' in windows)

note that the values in the open_basedir are prefixes, which means that anything under the /var/www/vhosts/domain.tld/zend will be accessible

0
1

In Parallels Plesk Panel (e.g. 1and1) you can do it in the PHP panel settings:

enter image description here

here:

enter image description here

2
  • Thx Igor, but why "ex: 1and1"? Do they not allow PHP overrides?
    – Jongosi
    Mar 15, 2015 at 0:37
  • Yes, but just through their panel. Maybe the confusion is because the word ex, I changed by e.g.
    – Igor Parra
    Mar 15, 2015 at 4:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.