open_basedir restriction in effect in Plesk for Windows

Question

I'm developing a CMS in PHP as a learning exercise but have hit a brickwall called "open_basedir restriction" - I am trying to upload a small JPG file. I've tried to give as much info as concisely as possible but let me know if I forgot anything!

I can see it hit the c:/windows/temp/ folder every time so its only falling over when trying to perform the move_uploaded_file operation.

After much research I know what this is and in theory how to fix it having read a number of pages online such as:

http://forum.parallels.com/showthread.php?258036-Plesk-Windows-open_basedir-restriction-in-effect

My Code

$uiq = uniqid();
$image_folder = "/img/articles/original/";
$uploaded = false;

if(isset($_POST['upload_image'])){ 
    if($_FILES['userImage']['error'] == 0 ){
        $up = move_uploaded_file($_FILES['userImage']['tmp_name'],  $image_folder.$_FILES['userImage']['name']);
        if($up){
        $uploaded = true;   
        }
    }
}

My PHPINFO

My PhpInfo results show that the root of my web hosting space is in the list of allowed folders:

open_basedir: F:\PLESK\WWW\mydomain.com\httpdocs\

The Error

PHP Warning: move_uploaded_file(): open_basedir restriction in effect. File(/img/articles/original/test.jpg) is not within the allowed path(s): (F:\PLESK\WWW\mydomain.com\httpdocs) in F:\PLESK\WWW\mydomain.com\httpdocs\sparklyphp\cms\modules\articles\edit\photos\index.php on line 40

More Errors

If I change my path

$image_folder = "/img/articles/original/";

to

$image_folder = "img/articles/original/";

I get additional errors:

PHP Warning:  move_uploaded_file(): open_basedir restriction in effect. File(C:\Windows\Temp\php393F.tmp) is not within the allowed path(s): (F:\PLESK\WWW\mydomain.com\httpdocs\) in F:\PLESK\WWW\mydomain.com\httpdocs\sparklyphp\cms\modules\articles\edit\photos\index.php on line 40
PHP Warning:  move_uploaded_file(): open_basedir restriction in effect. File(C:\Windows\Temp\php393F.tmp) is not within the allowed path(s): (F:\PLESK\WWW\mydomain.com\httpdocs\) in F:\PLESK\WWW\mydomain.com\httpdocs\sparklyphp\cms\modules\articles\edit\photos\index.php on line 40
PHP Warning:  move_uploaded_file(C:\Windows\Temp\php393F.tmp): failed to open stream: Operation not permitted in F:\PLESK\WWW\mydomain.com\httpdocs\sparklyphp\cms\modules\articles\edit\photos\index.php on line 40
PHP Warning:  move_uploaded_file(): Unable to move 'C:\Windows\Temp\php393F.tmp' to 'img/articles/original/test.jpg' in F:\PLESK\WWW\mydomain.com\httpdocs\sparklyphp\cms\modules\articles\edit\photos\index.php on line 40

** Hosting Environment ** The website hosting environment a Windows 2008 R2 box with Plesk 11.5 (the latest version/update) running PHP 5.4.16 in FastCGI mode. I have full admin access to the entire server.

The most frustrating thing here is that the file is being uploaded to the temp folder, I just can't get it from there!

Any help would be much appreciated!

Bob

Answer 1

I have NO IDEA why this worked. Ok so in the end I solved this by grabbing and storing the current working directory and switching the working directory to the root of the site:

$storeOriginalPath = getcwd();
chdir($_SERVER['DOCUMENT_ROOT']);

Performed the upload:

    $uiq = uniqid();
    $image_folder = "img/articles/original/";
    $uploaded = false;

    if(isset($_POST['upload_image'])){ 
            if($_FILES['userImage']['error'] == 0 ){
                $up = move_uploaded_file($_FILES['userImage']['tmp_name'], $image_folder.$_FILES['userImage']['name']);
                if($up){
                    $uploaded = true;   
                }
            }
    }

And switched back:

chdir($storeOriginalPath);

So I'm considering putting chdir($_SERVER['DOCUMENT_ROOT']); at start of all my PHP pages and having everything relative to the root (that's what I'm used to in ASP), is this common, ill-advised, smart, smelly or just plain stupid?

Answer 2

The path is wrong

$image_folder = "/img/articles/original/";
...
$up = move_uploaded_file($_FILES['userImage']['tmp_name'],  $image_folder...

The above code is going to try to move a file to an absolute location /img/... on a windows system, I assume that'll be interpreted to mean e.g. F:\img\...

Plesk, by default, only permits a php application to write to the document root of the domain, or the tmp folder - therefore probably what you require is to change the destination folder path:

 // edit this and make sure this points somewhere writable
$image_folder = "./img/articles/original/";

To write to a folder under the document root.

Answer 3

This:

PHP Warning:  move_uploaded_file(): open_basedir restriction in effect.
File(C:\Windows\Temp\php393F.tmp) is not within the allowed path(s):
(F:\PLESK\WWW\mydomain.com\httpdocs\) in
F:\PLESK\WWW\mydomain.com\httpdocs\sparklyphp\cms\modules\articles\edit\photos\index.php on line 40

is basically saying even your temp folder is not allowed. AFAIK that would be clearly a misconfiguration and you should contact your hosting to fix it. Or, if you have full admin access like you say you have, just change the open_basedir restriction to something sane. This page looks to contain instrcutions on changing/removing open_basedir settings.