is_file(): open_basedir restriction in effect

This forum is for issues with installing Joomla! 3.x on IIS webservers.

Moderator: General Support Moderators

Forum rules
Forum Rules
Absolute Beginner's Guide to Joomla! <-- please read before posting, this means YOU.
Forum Post Assistant - If you are serious about wanting help, you will use this tool to help you post.
jml345
Joomla! Apprentice
Joomla! Apprentice
Posts: 36
Joined: Tue Nov 03, 2015 9:14 am

is_file(): open_basedir restriction in effect

Postby jml345 » Wed Mar 02, 2016 3:22 pm

Hi,

I have a Joomla 3.4.8 + PHP 5.4.45 + IIS 7.5 + Win2008 installation.

When I try add a new item to a menu but I have this Warning:

Code: Select all

PHP Warning:  is_file(): open_basedir restriction in effect. File(\metadata.xml) is not within the allowed path(s): (C:/Inetpub/vhosts/my.website.com\;C:\Windows\Temp\) in C:\Inetpub\vhosts\my.website.com\httpdocs\administrator\components\com_menus\models\item.php on line 986


item.php file code:

Code: Select all

...
983            // Now check for a component manifest file
984               $path = JPath::clean($base . '/metadata.xml');
985
986               if (is_file($path))
987               {
987                  $formFile = $path;
988               }
...


I reviewed open_basedir at php.ini file and with function phpinfo() file and it´s OK.

Any solution?

Thanks,
Last edited by toivo on Wed Mar 02, 2016 3:27 pm, edited 1 time in total.
Reason: mod note: moved to the correct forum

User avatar
fcoulter
Joomla! Ace
Joomla! Ace
Posts: 1319
Joined: Thu Sep 13, 2007 11:39 am
Location: UK
Contact:

Re: is_file(): open_basedir restriction in effect

Postby fcoulter » Thu Mar 03, 2016 10:41 am

It looks to me as if $base might be an empty string, so that it is looking for the metadata.xml in the root folder. Just a guess.
http://www.spiralscripts.co.uk for Joomla! extensions
http://www.fionacoulter.com/blog my personal website
Security Forum moderator
VEL team member
"Wearing my tin foil hat with pride"

jml345
Joomla! Apprentice
Joomla! Apprentice
Posts: 36
Joined: Tue Nov 03, 2015 9:14 am

Re: is_file(): open_basedir restriction in effect

Postby jml345 » Thu Mar 03, 2016 11:17 am

fcoulter wrote:It looks to me as if $base might be an empty string, so that it is looking for the metadata.xml in the root folder. Just a guess.


From item.php file:

Code: Select all

         // Confirm that the option is defined.
         $option = '';
         $base = '';

         if (isset($args['option']))
         {
            // The option determines the base path to work with.
            $option = $args['option'];
            $base = JPATH_SITE . '/components/' . $option;
         }

         if (isset($args['view']))
         {
            $view = $args['view'];

            // Determine the layout to search for.
            if (isset($args['layout']))
            {
               $layout = $args['layout'];
            }
            else
            {
               $layout = 'default';
            }

            // Check for the layout XML file. Use standard xml file if it exists.
            $tplFolders = array(
               $base . '/views/' . $view . '/tmpl',
               $base . '/view/' . $view . '/tmpl'
            );
            $path = JPath::find($tplFolders, $layout . '.xml');

            if (is_file($path))
            {
               $formFile = $path;
            }

            // If custom layout, get the xml file from the template folder
            // template folder is first part of file name -- template:folder
            if (!$formFile && (strpos($layout, ':') > 0))
            {
               $temp = explode(':', $layout);
               $templatePath = JPath::clean(JPATH_SITE . '/templates/' . $temp[0] . '/html/' . $option . '/' . $view . '/' . $temp[1] . '.xml');

               if (is_file($templatePath))
               {
                  $formFile = $templatePath;
               }
            }
         }

         // Now check for a view manifest file
         if (!$formFile)
         {
            if (isset($view))
            {
               $metadataFolders = array(
                  $base . '/view/' . $view,
                  $base . '/views/' . $view
               );
               $metaPath = JPath::find($metadataFolders, 'metadata.xml');

               if (is_file($path = JPath::clean($metaPath)))
               {
                  $formFile = $path;
               }
            }
            else
            {
               // Now check for a component manifest file
               $path = JPath::clean($base . '/metadata.xml');

               if (is_file($path))
               //if (JFile::exists($path))
               {
                  $formFile = $path;
               }
            }
         }
      }

I try watch $base ... maybe it´s a Joomla Core bug ???

User avatar
Per Yngve Berg
Joomla! Master
Joomla! Master
Posts: 23582
Joined: Mon Oct 27, 2008 9:27 pm
Location: Akershus, Norway

Re: is_file(): open_basedir restriction in effect

Postby Per Yngve Berg » Fri Mar 04, 2016 7:53 am

Have you included System Temp Folder in the Open_basedir?

jml345
Joomla! Apprentice
Joomla! Apprentice
Posts: 36
Joined: Tue Nov 03, 2015 9:14 am

Re: is_file(): open_basedir restriction in effect

Postby jml345 » Fri Mar 04, 2016 8:19 am

Per Yngve Berg wrote:Have you included System Temp Folder in the Open_basedir?

Yes, I included: (from php.ini file)

Code: Select all

open_basedir = "C:/Inetpub/vhosts/my.website.com\;C:\Windows\Temp\;\"

jml345
Joomla! Apprentice
Joomla! Apprentice
Posts: 36
Joined: Tue Nov 03, 2015 9:14 am

Re: is_file(): open_basedir restriction in effect

Postby jml345 » Fri Mar 04, 2016 12:37 pm

fcoulter wrote:It looks to me as if $base might be an empty string, so that it is looking for the metadata.xml in the root folder. Just a guess.


Then I try bypass $base: (because maybe I think it´s JPATH_SITE problem)

Code: Select all

$base = JPATH_SITE . '/components/' . $option;

Code: Select all

$base = 'C:/Inetpub/vhosts\my.website.com\httpdocs' . '/components/' . $option;

but reponse it´s the same. :'(

User avatar
fcoulter
Joomla! Ace
Joomla! Ace
Posts: 1319
Joined: Thu Sep 13, 2007 11:39 am
Location: UK
Contact:

Re: is_file(): open_basedir restriction in effect

Postby fcoulter » Fri Mar 04, 2016 1:18 pm

It could be a problem with your programming logic. If neither $args['option'] nor $args['view'] are set then $base will remain empty. Yet this code will still execute:-

Code: Select all

           
            else
            {
               // Now check for a component manifest file
               $path = JPath::clean($base . '/metadata.xml');

               if (is_file($path))
               //if (JFile::exists($path))
               {
                  $formFile = $path;
               }
            }


I would add a check to see if $base is empty at that point, and only execute if it is not. Or set a default fallback value for base.

Or find some way to make sure at least one of $args['option'] or $args['view'] are set. You don't say where exactly the come from, I suppose from the URL request. Depending on when the code is executed I think it is sometimes possible for these parameters to not have a value, although in most cases you would expect the option to have a value.

If they are coming from the request you should also make sure that they are properly validated, to prevent the user injecting values that would allow directory traversal.
http://www.spiralscripts.co.uk for Joomla! extensions
http://www.fionacoulter.com/blog my personal website
Security Forum moderator
VEL team member
"Wearing my tin foil hat with pride"

User avatar
pvh123
Joomla! Ace
Joomla! Ace
Posts: 1125
Joined: Wed Oct 05, 2005 7:25 am
Location: Amsterdam

Re: is_file(): open_basedir restriction in effect

Postby pvh123 » Tue Mar 28, 2017 10:21 am

This problem still has not been resolved.
I am experiencing the problem with the latest version of Joomla.
I created a backup and restored to my local system and the problem was not there.
My hoster rund the environment as virtual hosting, may be that has influence.
Note: Sending me private messages for personal support, without this been requested, would lead to ignoring any of your posts in future!


Return to “Joomla! 3.x on IIS webserver”

Who is online

Users browsing this forum: No registered users and 2 guests