Issue Open basedir problem

[Erwan]

Hello,

We have deux websites we must exchange data on Plesk Onyx.
Until today, there was no problem for a site to access informations/files of the second and vice versa.
Two websites were with PHP 5.3.3 by OSVendor.

Today, we upgraded the first website to PHP 5.6.
Everything works except for access to files from the second site. There is an open_basedir restriction.

mod_fcgid: stderr: PHP Warning: is_file(): open_basedir restriction in effect. File(/var/www/vhosts/website1/httpdocs/app/../../../website2/httpdocs/cata/1860-AFpBFTRXVn/cata.pdf) is not within the allowed path(s): (/var/www/vhosts/website1/httpdocs/:/var/www/vhosts/website2/httpdocs/:/tmp) in /var/www/vhosts/website1/httpdocs/web/thefile/ on line 72, referer: https://website1/work/?t=3

But i don't why? All seems to be ok for open_basedir:
For the first website:
/var/www/vhosts/website1/httpdocs/:/var/www/vhosts/website2/httpdocs/:/tmp
For the second website:
/var/www/vhosts/website1/httpdocs/:/var/www/vhosts/website2/httpdocs/:/tmp

Safe_mode is off for the two websites.

The problem now persists when I return to the PHP 5.3.3.
So please help me?

 

[Erwan]

Anyone?
I'm short of ideas...

 

[AYamshanov]

Hi,

I'm not sure exactly.

"/var/www/vhosts/website1/httpdocs/app/../../../website2/httpdocs/cata/1860-AFpBFTRXVn/cata.pdf" => "/var/www/vhosts" + "/website2/httpdocs/cata/1860-AFpBFTRXVn/cata.pdf", but "/var/www/vhosts" not in open_basedir. Maybe something was changed in PHP since 5.3.3.

Could you write path to file without "../", just "/var/www/vhosts/website2/httpdocs/cata/1860-AFpBFTRXVn/cata.pdf"?

 

[AYamshanov]

One more thing:

"/var/www/vhosts/website1/httpdocs/app/../../../website2/" not equal "/var/www/vhosts/website2/" as string.

 

[Erwan]

It worked previously with ../
It's the same result with "/var/www/vhosts/website2/httpdocs/cata/1860-AFpBFTRXVn/cata.pdf"...


I'm going to be crazy....

 

[Erwan]

Is there anything other than "open_basedir" as restriction?

We no longer have the error message but can not access to the file... while the path is good

 

[AYamshanov]

Do you see any messages in logs while try get access to file?

/var/log/nginx/*
/var/log/httpd/*
/var/log/php-fpm/*
/var/log/plesk-php56-fpm/*

 

[Erwan]

AYamshanov,

Nothing about this problem in theses logs.

I've disable open_basedir restriction on the two websites.
I no longer have the error message Warning: is_file(): open_basedir restriction in effect.
But does not find the file.

I've made this simple script that i've put on the two websites:

<?php
$rep = '/var/www/vhosts/website2/httpdocs/file2.php';
if(is_file($rep)){
die("ok");
}else{
echo("No file");
}

==> "No file" when i call the website1 script
==> "Ok" when i call the website2 script

I do not know what to test...

 

[Erwan]

Is there anything other than open_basedir to prevent access to a file?

 

[AYamshanov]

I have reproduced the problem.

Could you look at permissions of "/var/www/vhosts/website2/" and "/var/www/vhosts/website2/httpdocs/".

php-fpm for website1 configured with something parameters like this (/etc/php-fpm.d/website1.conf):
user = website1
group = psacln

Permissions for website2 and website2/httpdocs looks like:
drwx--x--- 5 website2 psaserv 4096 Feb 28 11:36 website2
drwxr-x--- 5 website2 psaserv 4096 Feb 28 11:36 website2/httpdocs

So, just no file system permissions.

 

[Erwan]

I'm not sure to understand.
Permissions are:

drwx--x--- 15 ftpweb9 psaserv 4096 27 fevr. 13:39 website1
drwxr-x--- 8 ftpweb9 psaserv 4096 27 fevr. 13:38 website1/httpdocs
drwx--x--- 5 ftpweb10 psaserv 4096 18 avril 2016 website2
drwxr-x--- 6 ftpweb10 psaserv 4096 28 fevr. 10:31 website2/httpdocs

But i don't have something like that /etc/php-fpm.d/website1.conf. Only /etc/php.d/ directory.
I've /opt/plesk/php/5.6/etc/php-fpm.d directory but it's empty.

 

[Erwan]

I must add read access to website2 as for website2/httpdocs?
drwxr-x---

 

[AYamshanov]

Yes, you need add read permission for owner of website1 to directory of website2. I did it only for test by command "chmod a+rx website2 website2/httpdocs" but it's not secure because this allow read "website2" and "website2/httpdocs" for anyone on server.

 

[Erwan]

chmod a+rx website2 website2/httpdocs

There isn't another solution?
Why we don't have problem before (since 1 year)?

The only thing we change is the PHP 5.3.3 ==> 5.6.
When we return to 5.3.3, the problem still here.