1

I am trying to check if a file exists on the server. The difficulty that I am having is that file_exists returns false for a file that I know exists on the server.

My server is configured withsafe_mode = on in php.ini. Because of this I've added the directory that contains the file I want to check on using 

include_path=".:/path/to/dir"

I've also added the path to 

safe_mode_include_dir = /path/to/dir

file_exists("/path/to/dir/file") still returns FALSE.

Thanks in advance

Nikola K.
  • 7,093
  • 13
  • 31
  • 39
jimmyjambles
  • 1,631
  • 2
  • 20
  • 34

2 Answers2

2

If you have the ability to do so, disable safe_mode. It has been deprecated by the PHP development team, and is gone as of PHP 5.4.0, so you will need to stop depending on it sooner or later.

If you must use safe_mode, add the directory to open_basedir, not include_path.

  • Id rather not disable safe_mode just for this one issue, I tried using open_basedir, no success though, do I use it the same way I was trying to use include_path? – jimmyjambles Jul 04 '12 at 04:12
  • Yep -- `open_basedir` is a colon-separated list of extra directories that PHP is allowed to look at. –  Jul 04 '12 at 04:16
1

Sorry, but it's just not possible to circumvent safe mode restrictions - that's sort of the point of safe mode. If you want to include the file, you will still be able to do so if you have set safe_mode_include_dir to a path that will allow it to be accessed, but there is no way to get stat() related functions to work with it.

EDIT

A horrible and incredibly dangerous and unreliable work around might be this:

function file_exists_safemode ($file) {

  $oldErrorLevel = error_reporting(E_ALL);
  $oldDisplayErrors = ini_get('display_errors');
  ini_set('display_errors', 1);

  ob_start();
  include $file;
  $result = ob_get_clean();

  ini_set('display_errors', $oldDisplayErrors);
  error_reporting($oldErrorLevel);

  return strpos($result, 'failed to open stream') === FALSE;

}

...but it is so nasty in so many ways, and I definitely do not recommend this as an approach.

DaveRandom
  • 87,921
  • 11
  • 154
  • 174
  • I have full access to the target system so I was hoping to find something that short of disabling safe mode across the entire domain would allow me to access a folder that is not web visible. – jimmyjambles Jul 04 '12 at 04:13
  • @jimmyjambles Safe mode is [deprecated in 5.3 and completely removed from 5.4](http://php.net/manual/en/features.safe-mode.php) so it would be advisable to get used to it not being there anyway. [Here](http://stackoverflow.com/questions/4886912/when-or-for-what-reasons-should-folks-turn-php-safemode-on-off) is some more info. – DaveRandom Jul 04 '12 at 07:38