how to add an open_basedir path in nginx vhost

Question

In php.ini I've set

open_basedir = /home/user/web/

Now I would like to run phppgadmin on a subdomain which needs to include files from /usr/share/phppgadmin.
So I added the following line to the nginx-config for this host:

fastcgi_param PHP_VALUE open_basedir="/home/user/web/:/usr/share/phppgadmin/";

and restarted nginx. However, I can't access the site because of following error:

[error] 31440#0: *1 FastCGI sent in stderr: "PHP Warning: include_once(): open_basedir restriction in effect. File(/usr/share/phppgadmin/libraries/lib.inc.php) is not within the allowed path(s): (/home/user/web/) in /usr/share/phppgadmin/info.php on line 10

What could be the reason that the 2nd path isn't listed here? What else do I need to add an open_basedir to a virtual host? I only used the default file in /sites-available.

edit Always think of restarting fpm...

service php5-fpm restart

score 7 · Accepted Answer · answered Sep 23 '12 at 21:46

7

For your particular situation, you should consider just adding /usr/share to the default open_basedir, since anything in there is designed to be read by the world anyway.

Plus, open_basedir is easily circumvented unless you have locked down shell_exec, exec, system and similar PHP functions so don't consider secured for using it (I know, it sucks).

If you're wondering how you can circumvent it easily, you can just system('php -n ascript.php');. The -n will cause no PHP.ini to be read, so no open_basedir will be applied.

answered Sep 23 '12 at 21:46

Jay

6,439
24
34

thanks, I will keep in mind (and deactivate open_basedir). The problem of reloading ini was another one, I edited in my question. – 32bitfloat Sep 23 '12 at 23:14
But if you don't need these functions you can easily disable them in php.ini – Maciej Krawczyk Oct 21 '17 at 14:03

score 6 · Answer 2 · answered May 05 '17 at 18:22

Just FYI, if you have nginx configs set for multiple vhosts (so, configs in /etc/nginx/sites-enabled/example.com) then you may need to set the fastcgi_param PHP_VALUE open_basedir= there:

    location ~ \.php$ {
            try_files $uri =404;
            fastcgi_param PHP_VALUE open_basedir="/var/www/:/new/path";
            fastcgi_split_path_info ^(.+\.php)(/.+)$;
            fastcgi_pass unix:/var/run/php/php7.1-fpm.sock;
            fastcgi_index index.php;
            include fastcgi_params;

score 0 · Answer 3 · answered Nov 13 '19 at 16:42

0

Configuring open_basedir via fastcgi_param may cause some problems when there are multiple sites on your server.

The other option is to use .user.ini .

answered Nov 13 '19 at 16:42

Time Killer

101
3

how to add an open_basedir path in nginx vhost

3 Answers3