is_file(): open_basedir restriction in effect

This forum is for issues with installing Joomla! 3.x on IIS webservers.

Moderator: General Support Moderators

Forum rules
Forum Rules
Absolute Beginner's Guide to Joomla! <-- please read before posting, this means YOU.
Forum Post Assistant - If you are serious about wanting help, you will use this tool to help you post.
Post Reply
jml345
Joomla! Apprentice
Joomla! Apprentice
Posts: 38
Joined: Tue Nov 03, 2015 9:14 am

is_file(): open_basedir restriction in effect

Post by jml345 » Wed Mar 02, 2016 3:22 pm

Hi,

I have a Joomla 3.4.8 + PHP 5.4.45 + IIS 7.5 + Win2008 installation.

When I try add a new item to a menu but I have this Warning:

Code: Select all

PHP Warning:  is_file(): open_basedir restriction in effect. File(\metadata.xml) is not within the allowed path(s): (C:/Inetpub/vhosts/my.website.com\;C:\Windows\Temp\) in C:\Inetpub\vhosts\my.website.com\httpdocs\administrator\components\com_menus\models\item.php on line 986
item.php file code:

Code: Select all

...
983				// Now check for a component manifest file
984					$path = JPath::clean($base . '/metadata.xml');
985
986					if (is_file($path))
987					{
987						$formFile = $path;
988					}
...
I reviewed open_basedir at php.ini file and with function phpinfo() file and it´s OK.

Any solution?

Thanks,
Last edited by toivo on Wed Mar 02, 2016 3:27 pm, edited 1 time in total.
Reason: mod note: moved to the correct forum

User avatar
fcoulter
Joomla! Ace
Joomla! Ace
Posts: 1685
Joined: Thu Sep 13, 2007 11:39 am
Location: UK
Contact:

Re: is_file(): open_basedir restriction in effect

Post by fcoulter » Thu Mar 03, 2016 10:41 am

It looks to me as if $base might be an empty string, so that it is looking for the metadata.xml in the root folder. Just a guess.
http://www.spiralscripts.co.uk for Joomla! extensions
http://www.fionacoulter.com/blog my personal website
Security Forum moderator :: VEL team member
"Wearing my tin foil hat with pride"

jml345
Joomla! Apprentice
Joomla! Apprentice
Posts: 38
Joined: Tue Nov 03, 2015 9:14 am

Re: is_file(): open_basedir restriction in effect

Post by jml345 » Thu Mar 03, 2016 11:17 am

fcoulter wrote:It looks to me as if $base might be an empty string, so that it is looking for the metadata.xml in the root folder. Just a guess.
From item.php file:

Code: Select all

			// Confirm that the option is defined.
			$option = '';
			$base = '';

			if (isset($args['option']))
			{
				// The option determines the base path to work with.
				$option = $args['option'];
				$base = JPATH_SITE . '/components/' . $option;
			}

			if (isset($args['view']))
			{
				$view = $args['view'];

				// Determine the layout to search for.
				if (isset($args['layout']))
				{
					$layout = $args['layout'];
				}
				else
				{
					$layout = 'default';
				}

				// Check for the layout XML file. Use standard xml file if it exists.
				$tplFolders = array(
					$base . '/views/' . $view . '/tmpl',
					$base . '/view/' . $view . '/tmpl'
				);
				$path = JPath::find($tplFolders, $layout . '.xml');

				if (is_file($path))
				{
					$formFile = $path;
				}

				// If custom layout, get the xml file from the template folder
				// template folder is first part of file name -- template:folder
				if (!$formFile && (strpos($layout, ':') > 0))
				{
					$temp = explode(':', $layout);
					$templatePath = JPath::clean(JPATH_SITE . '/templates/' . $temp[0] . '/html/' . $option . '/' . $view . '/' . $temp[1] . '.xml');

					if (is_file($templatePath))
					{
						$formFile = $templatePath;
					}
				}
			}

			// Now check for a view manifest file
			if (!$formFile)
			{
				if (isset($view))
				{
					$metadataFolders = array(
						$base . '/view/' . $view,
						$base . '/views/' . $view
					);
					$metaPath = JPath::find($metadataFolders, 'metadata.xml');

					if (is_file($path = JPath::clean($metaPath)))
					{
						$formFile = $path;
					}
				}
				else
				{
					// Now check for a component manifest file
					$path = JPath::clean($base . '/metadata.xml');

					if (is_file($path))
					//if (JFile::exists($path))
					{
						$formFile = $path;
					}
				}
			}
		}
I try watch $base ... maybe it´s a Joomla Core bug ???

User avatar
Per Yngve Berg
Joomla! Master
Joomla! Master
Posts: 24806
Joined: Mon Oct 27, 2008 9:27 pm
Location: Akershus, Norway

Re: is_file(): open_basedir restriction in effect

Post by Per Yngve Berg » Fri Mar 04, 2016 7:53 am

Have you included System Temp Folder in the Open_basedir?

jml345
Joomla! Apprentice
Joomla! Apprentice
Posts: 38
Joined: Tue Nov 03, 2015 9:14 am

Re: is_file(): open_basedir restriction in effect

Post by jml345 » Fri Mar 04, 2016 8:19 am

Per Yngve Berg wrote:Have you included System Temp Folder in the Open_basedir?
Yes, I included: (from php.ini file)

Code: Select all

open_basedir = "C:/Inetpub/vhosts/my.website.com\;C:\Windows\Temp\;\"

jml345
Joomla! Apprentice
Joomla! Apprentice
Posts: 38
Joined: Tue Nov 03, 2015 9:14 am

Re: is_file(): open_basedir restriction in effect

Post by jml345 » Fri Mar 04, 2016 12:37 pm

fcoulter wrote:It looks to me as if $base might be an empty string, so that it is looking for the metadata.xml in the root folder. Just a guess.
Then I try bypass $base: (because maybe I think it´s JPATH_SITE problem)

Code: Select all

$base = JPATH_SITE . '/components/' . $option;

Code: Select all

$base = 'C:/Inetpub/vhosts\my.website.com\httpdocs' . '/components/' . $option;
but reponse it´s the same. :'(

User avatar
fcoulter
Joomla! Ace
Joomla! Ace
Posts: 1685
Joined: Thu Sep 13, 2007 11:39 am
Location: UK
Contact:

Re: is_file(): open_basedir restriction in effect

Post by fcoulter » Fri Mar 04, 2016 1:18 pm

It could be a problem with your programming logic. If neither $args['option'] nor $args['view'] are set then $base will remain empty. Yet this code will still execute:-

Code: Select all

            
            else
            {
               // Now check for a component manifest file
               $path = JPath::clean($base . '/metadata.xml');

               if (is_file($path))
               //if (JFile::exists($path))
               {
                  $formFile = $path;
               }
            }
I would add a check to see if $base is empty at that point, and only execute if it is not. Or set a default fallback value for base.

Or find some way to make sure at least one of $args['option'] or $args['view'] are set. You don't say where exactly the come from, I suppose from the URL request. Depending on when the code is executed I think it is sometimes possible for these parameters to not have a value, although in most cases you would expect the option to have a value.

If they are coming from the request you should also make sure that they are properly validated, to prevent the user injecting values that would allow directory traversal.
http://www.spiralscripts.co.uk for Joomla! extensions
http://www.fionacoulter.com/blog my personal website
Security Forum moderator :: VEL team member
"Wearing my tin foil hat with pride"

User avatar
pvh123
Joomla! Ace
Joomla! Ace
Posts: 1125
Joined: Wed Oct 05, 2005 7:25 am
Location: Amsterdam

Re: is_file(): open_basedir restriction in effect

Post by pvh123 » Tue Mar 28, 2017 10:21 am

This problem still has not been resolved.
I am experiencing the problem with the latest version of Joomla.
I created a backup and restored to my local system and the problem was not there.
My hoster rund the environment as virtual hosting, may be that has influence.
Note: Sending me private messages for personal support, without this been requested, would lead to ignoring any of your posts in future!


Post Reply

Return to “Joomla! 3.x on IIS webserver”