<html><head><meta http-equiv="Content-Type" content="text/html charset=iso-8859-1"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><div>Hi David & RC.</div><div><br></div><div>On 09/02/2013, at 7:03 AM, David Hahn <<a href="mailto:ml@sb9.com">ml@sb9.com</a>> wrote:</div><div><br class="Apple-interchange-newline"><blockquote type="cite">
<meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type">
<div bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 2/8/2013 10:31 AM, Richard Barker
wrote:<br>
</div>
<blockquote cite="mid:51154465.8000802@probass.com" type="cite">
<pre wrap="">After installing a component in Joomla 2.5.9 I get this error when
trying to use that component.
PHP Warning: require_once(): open_basedir restriction in effect.
File(/usr/share/pear/PEAR.php) is not within the allowed path(s):
The site php path is this:
Open Basedir (Server):
/home/
/home/.sites/70/site4
/tmp/
/usr/sausalito/configs/php/
/var/lib/php/session/
/var/www/html/
And the Open Basedir (Vsite):
is empty
Thanks,
RC
</pre>
</blockquote>
Try using just '/' forward slash in the GUI. <font style="font-family:Arial,Helvetica,sans-serif;font-size:12px;"><a style="font-family: Arial, Helvetica, sans-serif; font-size: 12px; text-decoration: none; " href="javascript: void 0" onmouseover=" return
top.code.info_mouseOver(document._label_10_description)" onmouseout=" return top.code.info_mouseOut();">Open Basedir
(Vsite):</a> field</font><br>
This defeats the security of open base but allows the script to run.<br>
HTH<br>
David<br>
</div>
</blockquote></div><br></div><div>Doesn't it make more sense to allow ONLY the directory you need for your app, instead of disabling openbasedir security totally? If I had a user who had trouble remembering his password, would I fix that by turning off passwords for all users? I don't think so.</div><div><br></div><div>If you bypass openbasedir, a vulnerability in a PHP app in one vsite may be able to modify files in more than just one vsite - especially if you are not using suphp. Thats why openbasedir was invented. In the early days - Michael blocked doing stuff like putting this to help keep people secure... but too many people complained. I personally wish he did not relent and kept the logic in there to stop this type of insecure configuration.</div><div><br></div><div>Lets think about what is actually required. The log says that /usr/share/pear/PEAR.php is not in the allowed paths. Wouldnt it make more sense to just add /usr/share/pear/ into the server wide allowed path? This will keep this joomla module happy, and at the same time keep the server secure.</div><div><br></div><div>Regards,</div><div>Greg.</div></body></html>