# open_basedir bypass - Thread: https://externals.io/message/55637 - Original archive: https://news-web.php.net/php.internals/55637 - Started by Reindl Harald on 2011-09-27T08:58:22+00:00 - Messages: 23 - Reply by email to internals@lists.php.net - More for agents: search with https://externals.io/search.md?q={query} · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt --- ## #55637 — Reindl Harald — 2011-09-27T08:58:22+00:00 URL: https://externals.io/message/55637#55637 below a correct open_basedir restriction but why can `fopen()` create this file outside the basedir and after that the restriction is active? this means in other words: `fopen()` can empty files outside the basedir if their permissions are open enough Sep 27 10:53:26 open_basedir restriction in effect. File(/tmp/rhcsvz8QeBL) is not within the allowed path(s): (/etc/httpd/conf/panel:/Volumes/dune/www-servers/phpincludes:/usr/share/pear) Sep 27 10:53:26 PHP Warning: fopen(/tmp/rhcsvz8QeBL): failed to open stream: Operation not permitted in /Volumes/dune/www-servers/phpincludes/global_rh_csv.inc.php on line 2 [root@arrakis:~]$ stat /tmp/rhcsvz8QeBL File: „/tmp/rhcsvz8QeBL“ Size: 0 Blocks: 0 IO Block: 4096 reguläre leere Datei Device: 10h/16d Inode: 6310677 Links: 1 Access: (0600/-rw-------) Uid: ( 48/ apache) Gid: ( 48/ apache) Access: 2011-09-27 10:53:26.894004321 +0200 Modify: 2011-09-27 10:53:26.894004321 +0200 Change: 2011-09-27 10:53:26.894004321 +0200 --- ## #55639 — Reindl Harald — 2011-09-27T22:19:35+00:00 URL: https://externals.io/message/55637#55639 Am 28.09.2011 00:16, schrieb Ángel González: > Reindl Harald wrote: > > […] > Are you sure it is the `fopen()` what is making it? > I think that some other function/extension may be creating the temporary file > /tmp/rhcsvz8QeBL for you to open, which then fails due to the open_basedir. errata - it is `tempnam()` if $dir is not writeable which falls back to /tmp this fallback should not happen if /tmp is NOT in open_basedir and tempname() should spit out the error instead the following `fopen()` better would be if `tempnam()` stops and gives out a warning that $dir is not writeable - it had a reason that the $dir param was used and if there is an error it is a bad behavior that php takes something else we are speaking about a programming language and not a gambling machine :-) --- ## #55641 — Reindl Harald — 2011-09-27T22:39:00+00:00 URL: https://externals.io/message/55637#55641 Am 28.09.2011 00:34, schrieb Ángel González: > Reindl Harald schrieb: > > […] > I had also tried with `tempnam()` [there's not tempname()], and it correctly spitted > an open_basedir error and didn't create the file. > Which php version are you using? PLEASE REPLY ONLY TO THE LIST this was the second time that i used one of your two copies and replied off-list the first time, if you get a mail from a mailing-list the sender gets your answer if it goes to the list only :-) 5.3.8 $GLOBALS['cl_api']->folders->temp = dirname(__FILE__) . '/temp/'; that was why i did first not understand why /tmp ever was used and than it took some time to realize that /tmp is used because $GLOBALS['cl_api']->folders->temp was not writeable and that the temporary files were created with zero bytes $tmp_name = str_replace("\\", '/', tempnam($GLOBALS['cl_api']->folders->temp, 'rhcsv')); $fp = fopen($tmp_name, 'wb+'); if($fp) { flock($fp, LOCK_EX); fwrite($fp, $data); flock($fp, LOCK_UN); fclose($fp); } --- ## #55642 — Antony Dovgal — 2011-09-28T06:01:09+00:00 URL: https://externals.io/message/55637#55642 · In reply to: #55641 > PLEASE REPLY ONLY TO THE LIST Please provide a short (10 lines max) but complete reproduce script. At the moment your explanations do not make any sense. -- Wbr, Antony Dovgal --- http://pinba.org - realtime profiling for PHP --- ## #55643 — Reindl Harald — 2011-09-28T07:02:17+00:00 URL: https://externals.io/message/55637#55643 · In reply to: #55642 Am 28.09.2011 08:01, schrieb Antony Dovgal: > > > […] > > Please provide a short (10 lines max) but complete reproduce script. > At the moment your explanations do not make any sense. what do you think was the content of my last mail where you quoted only a part of the "mailing-list-manual"? this was code directly from the library where te problem exists, well i will help you to complete a 5-liner to make its "wrong" permissions and replace a class-var.... what exactly does not make sense? * /tmp MUST NOT be in open_basedir * the temp-folder must be read only * QUESTION1: why is `tempnam()` falling back to a dir outside open_basedir? * QUESTION2: why is `tempnam()` creating a file OUTSIDE open_basedir? * QUESTION3: why is there no error-msg taht $dir is readonly instead unexpected fallback Warning: `fopen()` [function.fopen.php]: open_basedir restriction in effect. File(/tmp/rhcsv5f9RIs) is not within the allowed path(s): (/mnt/data/www/beta.rhsoft.net:/Volumes/dune/www-servers/phpincludes:/var/www/uploadtemp) in /mnt/data/www/beta.rhsoft.net/tempname.php on line 6 Warning: fopen(/tmp/rhcsv5f9RIs) [function.fopen.php]: failed to open stream: Operation not permitted in /mnt/data/www/beta.rhsoft.net/tempname.php on line 6 [harry@srv-rhsoft:~]$ stat /tmp/rhcsv5f9RIs Datei: „/tmp/rhcsv5f9RIs“ Größe: 0 Blöcke: 0 EA Block: 4096 reguläre leere Datei Gerät: 809h/2057d Inode: 48 Verknüpfungen: 1 Zugriff: (0600/-rw-------) Uid: ( 48/ apache) Gid: ( 48/ apache) Zugriff : 2011-09-28 08:58:01.046916064 +0200 Modifiziert: 2011-09-28 08:58:01.046916064 +0200 Geändert : 2011-09-28 08:58:01.046916064 +0200 --- ## #55644 — Pierre Joye — 2011-09-28T07:28:17+00:00 URL: https://externals.io/message/55637#55644 · In reply to: #55643 >  $tmp_name = str_replace("\\", '/', tempnam($temp_folder, 'rhcsv')); Side note: this is never necessary, php does it for you. Unless you store paths yourself before calling a php file function. -- Pierre @pierrejoye | http://blog.thepimp.net | http://www.libgd.org --- ## #55645 — Reindl Harald — 2011-09-28T08:17:28+00:00 URL: https://externals.io/message/55637#55645 · In reply to: #55644 Am 28.09.2011 09:28, schrieb Pierre Joye: > > > > […] > > Side note: this is never necessary, php does it for you. Unless you > store paths yourself before calling a php file function i know this is my way to make sure that even on windows there are never backslashes used and probably translations from realpaths to urls are failing because of that --- ## #55646 — Pierre Joye — 2011-09-28T08:46:41+00:00 URL: https://externals.io/message/55637#55646 · In reply to: #55643 hi, First, all you need to test is: $tempfile = tempnam($temp_folder, 'rhcsv'); $fp = fopen($tempfile , 'w'); > * /tmp MUST NOT be in open_basedir > * the temp-folder must be read only > * QUESTION1: why is `tempnam()` falling back to a dir outside open_basedir? > * QUESTION2: why is `tempnam()` creating a file OUTSIDE open_basedir? The flow can be easily seen here: http://lxr.php.net/opengrok/xref/PHP_5_4/ext/standard/file.c#798 http://lxr.php.net/xref/PHP_5_4/main/php_open_temporary_file.c#php_do_open_temporary_file > * QUESTION3: why is there no error-msg taht $dir is readonly instead unexpected fallback It is how it always work for temp files. Configure the temp directories correctly is the way to go (set the TMP). As far as I remember there was a discussion about temp directories and open base dir a while back, maybe you can find some additional info in it. Cheers, -- Pierre @pierrejoye | http://blog.thepimp.net | http://www.libgd.org --- ## #55647 — Reindl Harald — 2011-09-28T08:50:06+00:00 URL: https://externals.io/message/55637#55647 · In reply to: #55646 Am 28.09.2011 10:46, schrieb Pierre Joye: > hi, > > > > First, all you need to test is: > > $tempfile = tempnam($temp_folder, 'rhcsv'); > $fp = fopen($tempfile , 'w'); > > > […] > > The flow can be easily seen here: > > http://lxr.php.net/opengrok/xref/PHP_5_4/ext/standard/file.c#798 > http://lxr.php.net/xref/PHP_5_4/main/php_open_temporary_file.c#php_do_open_temporary_file > > > […] > > It is how it always work for temp files. Configure the temp > directories correctly is the way to go (set the TMP). As far as I > remember there was a discussion about temp directories and open base > dir a while back, maybe you can find some additional info in it. but it is wrong to create a file outside the open_basedir especially if a full qualified directory was passed where it should be created without any param /tmp is right but not as magical fallback and in my opinion a well desigend webapp should never touch global /tmp shared with other hosts and applications --- ## #55648 — Pierre Joye — 2011-09-28T08:53:51+00:00 URL: https://externals.io/message/55637#55648 · In reply to: #55647 > without any param /tmp is right but not as magical fallback and in > my opinion a well desigend webapp should never touch global /tmp > shared with other hosts and applications Well, a well configured shared host has correct temporary directory set. In any case, please open a bug at bugs.php.net so we can follow this possible more closely. Please use the very simply script I use as it is all we need to debug it. Cheers, -- Pierre @pierrejoye | http://blog.thepimp.net | http://www.libgd.org --- ## #55649 — Pierre Joye — 2011-09-28T09:00:34+00:00 URL: https://externals.io/message/55637#55649 · In reply to: #55647 > but it is wrong to create a file outside the open_basedir especially > if a full qualified directory was passed where it should be created Forgot to mention that this behavior is clearly documented: http://www.php.net/tempnam So it is not sure that we will fix that any time soon. Cheers, -- Pierre @pierrejoye | http://blog.thepimp.net | http://www.libgd.org --- ## #55650 — Reindl Harald — 2011-09-28T09:09:31+00:00 URL: https://externals.io/message/55637#55650 · In reply to: #55648 Am 28.09.2011 10:53, schrieb Pierre Joye: > without any param /tmp is right but not as magical fallback and in > my opinion a well desigend webapp should never touch global /tmp > shared with other hosts and applications Well, a well configured shared host has correct temporary directory set. In any case, please open a bug at bugs.php.net so we can follow this possible more closely. Please use the very simply script I use as it is all we need to debug it. well, temporary directory must not matter if path is explicit passed via param https://bugs.php.net/bug.php?id=55804 > Forgot to mention that this behavior is clearly documented: > http://www.php.net/tempnam > So it is not sure that we will fix that any time soon. documentation makes wrong behavior not right fact is that a php-function must not create files outside open_basedir with only two eexceptions which are for security reasons * session save path (must not be in open_basedir) * upload dir (must not be in open_basedir) --- ## #55651 — Hannes Magnusson — 2011-09-28T14:19:48+00:00 URL: https://externals.io/message/55637#55651 · In reply to: #55641 > PLEASE REPLY ONLY TO THE LIST PLEASE READ THE POSTING GUIDELINES BEFORE SCREAMING: http://se.php.net/mailing-lists.php "Be sure to click Reply-All to reply to list. Clicking Reply will email the author of the message privately." -Hannes --- ## #55652 — Reindl Harald — 2011-09-28T14:42:35+00:00 URL: https://externals.io/message/55637#55652 · In reply to: #55651 Am 28.09.2011 16:19, schrieb Hannes Magnusson: > > > […] > > PLEASE READ THE POSTING GUIDELINES BEFORE SCREAMING: > http://se.php.net/mailing-lists.php please configure the mailing-list correct please add a hint that modern clients have a "reply-to-list" please add a hint that the sender should be removed after reply-all because "internals@lists.php.net" is reaching the list AND the sender of the post where you write your answer > "Be sure to click Reply-All to reply to list. Clicking Reply will > email the author of the message privately." well if there would be used "Reply-To"-Headers tell me ONE reason to get every answer twice using "reply-to-list" will only answer to the mailinglist this is why the following headers exists list-help: list-unsubscribe: list-post: List-Id: internals.lists.php.net --- ## #55653 — johannes@schlueters.de — 2011-09-28T14:56:27+00:00 URL: https://externals.io/message/55637#55653 · In reply to: #55652 > Am 28.09.2011 16:19, schrieb Hannes Magnusson: > > […] > > please configure the mailing-list correct It is configured correctly. > please add a hint that the sender should be removed after > reply-all because "internals@lists.php.net" is reaching the > list AND the sender of the post where you write your answer I want to receive two copies. > > […] > > well if there would be used "Reply-To"-Headers > tell me ONE reason to get every answer twice One copy goes to my inbox. The other one goes to the mailing list specific folder. A mail in my inbox tells me that's it is likely that I want to read it with higher priority than the list folder does. An answer to a discussion I participated has higher priority than other discussions. This all isn't part of the discussion from this thread, though. johannes --- ## #55654 — Ferenc Kovacs — 2011-09-28T15:03:33+00:00 URL: https://externals.io/message/55637#55654 · In reply to: #55652 > please configure the mailing-list correct > please add a hint that modern clients have a "reply-to-list" for the record, I don't have that in gmail. > please add a hint that the sender should be removed after > reply-all because "internals@lists.php.net" is reaching the > list AND the sender of the post where you write your answer and what if the sender is not subscribed to the list? > > […] > > well if there would be used "Reply-To"-Headers > tell me ONE reason to get every answer twice I don't get two emails in gmail, I don't know that the list is smart enough to not send emails those who are to or cc'ed, or maybe it's a gmail feature. > using "reply-to-list" will only answer to the mailinglist > this is why the following headers exists > > list-help: > list-unsubscribe: > list-post: > List-Id: internals.lists.php.net thats not the main reason why those headers exists AFAIK, but I agree that it could be used for reply-to-list as I mentioned before, nobody knows every participant in the list, so if you reply someone, it is better to not only send it to the list.but to that person also, because you don't know that he is on the list or not. -- Ferenc Kovács @Tyr43l - http://tyrael.hu --- ## #55655 — Rasmus Lerdorf — 2011-09-28T15:05:18+00:00 URL: https://externals.io/message/55637#55655 · In reply to: #55652 Reindl, please read http://www.unicom.com/pw/reply-to-harmful.html The list is configured correctly. > > Am 28.09.2011 16:19, schrieb Hannes Magnusson: > > […] > > please configure the mailing-list correct please add a hint that > modern clients have a "reply-to-list" > > please add a hint that the sender should be removed after reply-all > because "internals@lists.php.net" is reaching the list AND the sender > of the post where you write your answer > > > […] > > well if there would be used "Reply-To"-Headers tell me ONE reason to > get every answer twice > > using "reply-to-list" will only answer to the mailinglist this is why > the following headers exists > > list-help: list-unsubscribe: > list-post: > List-Id: internals.lists.php.net --- ## #55656 — Reindl Harald — 2011-09-28T15:11:19+00:00 URL: https://externals.io/message/55637#55656 · In reply to: #55654 Am 28.09.2011 17:03, schrieb Ferenc Kovacs: > > […] > > for the record, I don't have that in gmail. > > > […] > > and what if the sender is not subscribed to the list? then he can usually not send to a list > I don't get two emails in gmail, I don't know that the list is smart > enough to not send emails those who are to or cc'ed, or maybe it's a > gmail feature. you get them not if the person who answered was smart enough to use "reply to list" or deleted the second address > > […] > > thats not the main reason why those headers exists AFAIK, but I agree > that it could be used for reply-to-list > > as I mentioned before, nobody knows every participant in the list, so > if you reply someone, it is better to not only send it to the list.but > to that person also, because you don't know that he is on the list or > not. normally you have to subscribe for sending to a list and i would wonder if every spambot can anonymously post to php-devel, so if somebody sends to the list he also receives it Am 28.09.2011 17:05, schrieb Rasmus Lerdorf: > Reindl, please read http://www.unicom.com/pw/reply-to-harmful.html > The list is configured correctly well and there i read the text below and that was the reason why i said last night PLEASE reply only to the list because i need not every message twice and answering to the wrong duplicate leaves the list out, one of you both mails has "reply to list" and the other copy not, if i use the other copy you get a lonely answer leaving the list out of rcpt > > […] --- ## #55657 — Nikita Popov — 2011-09-28T15:25:27+00:00 URL: https://externals.io/message/55637#55657 · In reply to: #55656 Hi Reindl! Do you realize that you are currently spamming hundreds of people that have subscribed this mailing list with pointless meta-discussions about how you think mailing list should work? The previous answer have already explained in detail why *all* mailing lists (this is not something specific to php-internals) ask you to reply to both author and the list. I would kindly ask you to stop annoying me and others with further off topic messages and hope that the mailing list management will discard your messages if you continue to do so. Thanks. > > > Am 28.09.2011 17:03, schrieb Ferenc Kovacs: > > […] > > then he can usually not send to a list > > > […] > > you get them not if the person who answered was smart enough > to use "reply to list" or deleted the second address > > > […] > > normally you have to subscribe for sending to a list and i would wonder > if every spambot can anonymously post to php-devel, so if somebody sends > to the list he also receives it > > Am 28.09.2011 17:05, schrieb Rasmus Lerdorf: > > […] > > well and there i read the text below > > and that was the reason why i said last night PLEASE reply only to the > list because i need not every message twice and answering to the > wrong duplicate leaves the list out, one of you both mails has "reply to list" > and the other copy not, if i use the other copy you get a lonely answer > leaving the list out of rcpt > > > […] --- ## #55659 — Ferenc Kovacs — 2011-09-28T21:45:27+00:00 URL: https://externals.io/message/55637#55659 · In reply to: #55658 2011/9/28 Ángel González : > Ferenc Kovacs wrote: > > […] > > That's a gmail (mis)feature. > If you receive an email twice, it is collapsed into one. thanks > A benefit of being addressed in the email that hasn't been mentioned yet, johannes mentioned it: http://www.mail-archive.com/internals@lists.php.net/msg53737.html -- Ferenc Kovács @Tyr43l - http://tyrael.hu --- ## #55658 — keisial@gmail.com — 2011-09-28T21:46:23+00:00 URL: https://externals.io/message/55637#55658 · In reply to: #55654 Ferenc Kovacs wrote: > > […] > I don't get two emails in gmail, I don't know that the list is smart > enough to not send emails those who are to or cc'ed, or maybe it's a > gmail feature. That's a gmail (mis)feature. If you receive an email twice, it is collapsed into one. A benefit of being addressed in the email that hasn't been mentioned yet, is that some people use that for email filtering, marking higher emails that are set to them. It is popular for instance among developers of linux kernel, where they don't usually read the very active list (lkml), so you are requested to email the list *and* CC the people that is likely to be interested in that field. Even though those people are subscribed to the list, they are not reading all of it. --- ## #55660 — Stas Malyshev — 2011-09-28T22:03:08+00:00 URL: https://externals.io/message/55637#55660 · In reply to: #55659 Hi! > > […] I actually don't get emails twice when replied to personally and on the list too... Not gmail, exchange+Thunderbird, no idea who of them does it but I'm OK with it. -- Stanislav Malyshev, Software Architect SugarCRM: http://www.sugarcrm.com/ (408)454-6900 ext. 227 --- ## #55661 — keisial@gmail.com — 2011-09-28T22:12:23+00:00 URL: https://externals.io/message/55637#55661 · In reply to: #55659 Ferenc Kovacs wrote: > > […] > johannes mentioned it: > http://www.mail-archive.com/internals@lists.php.net/msg53737.html > Yes, I noticed it /after/ sending. :( Our emails were alike. We mentioned the same usage pattern and both changed the subject.