got a problem with open_basedir restrictions

[ovidiu]

found this in my error log:

Code: Select all

[Tue Jun 07 17:34:18 2011] [warn] [client 145.253.32.107] mod_fcgid: stderr: PHP Warning:  file_exists(): open_basedir restriction in effect. File(/var/www/clients/clientxx/webxx/wp-config.php) is not within the allowed path(s): (/var/www/clients/clientxx/webxx/web:/var/www/clients/clientxx/webxx/tmp:/var/www/knightsenglish.com/web:/srv/www/knightsenglish.com/web:/usr/share/php5:/usr/share/php/PEAR:/tmp:/usr/share/phpmyadmin:/etc/phpmyadmin:/var/lib/phpmyadmin) in /var/www/clients/client6/web11/web/wp-content/plugins/quick-cache/includes/classes/menu-pages.inc.php on line 308, referer: http://www.knightsenglish.com/wp-admin/admin.php?page=ws-plugin--qcache-options

there is something obviously wrong here as your plugin is looking for wp-config.php here:

File(/var/www/clients/clientxx/webxx/wp-config.php) is not within the allowed path(s):

and that is not the root directory!!! the right path would be: /var/www/clients/clientxx/webxx/web/ so I am unsure where this problem comes from

found one of your plugin files and the code looks like this:

Code: Select all

else if (file_exists (dirname (ABSPATH) . "/wp-config.php") && !is_writable (dirname (ABSPATH) . "/wp-config.php"))

and sometimes it looks like this:

Code: Select all

(ABSPATH . "wp-config.php")

- notice the missing / in front of wp-config.php

is that right? if yes, why would ABSPATH not report the right absolute path?

[teratechnologies]

This is very strange indeed.

I have 4 websites on the same server all running the same version of WP (3.2.1). I installed QC in 2 of them and QC worked well. I went on to install QC on my other 2 sites and now they have the same open_basedir restriction problems...

That would lead me to believe that the errors you found in the code are not errors, but that something is off in my last 2 website's folder structure or configuration. However, I do think there should be an extra "/" before "wp-config.php".

It's tough to get support on a free product though...

[DDVille]

Open_basedir is a PHP security restriction used to limit access to server directories (for example) when a site is hacked and a PHP shell script is uploaded.

I suspect the error's being caused because WP automatically tries to locate wp-config.php one directory above the WordPress root index.php file. This should usually only happen when wp-config.php is not found in the same directory as index.php. For some reason, Quick Cache, and a few other plugins, try to find wp-config.php above the WordPress installation directory even when wp-config.php is located in the WordPress directory.

The error doesn't seem to prevent Quick Cache from enabling caching by editing wp-config.php so maybe it's not serious but I hope it's fixed soon.

I don't recommend switching off open_basedir restrictions because doing so will leave your server wide open to attack should a hacker gain access to it.

This probably hasn't helped you guys but maybe it'll help the developers write a bugfix.

[DDVille]

However, I do think there should be an extra "/" before "wp-config.php".

Apache should normally add the forward slash prefix itself. Might be better if the developers set the plugin to look for wp-config.php in the WordPress root directory, then in the directory above only if wp-config.php can't be found in the root directory.