open_basedir restriction in effect. File(/) is not within the allowed path(s):

Question

I'm getting this error on an avatar upload on my site. I've never gotten it before and nothing was changed recently for me to begin getting this error...

Warning: is_writable() [function.is-writable]: 
open_basedir restriction in effect. 
File(/) is not within the allowed path(s):

somebody please clarify if the currently accepted answer is the working one. and then @sjas, please edit or delete your comment. It's confusing. :| — Yogesh, Oct 07 '21 at 11:36
@Yogesh it works fine. Of course, I'm using Plesk. I believe sjas was in error, although that might have been because he/she was using something other than plesk. I'm willing to assume by Ben accepting the answer that he's using Plesk, too. — JBH, Apr 26 '22 at 02:09

score 144 · Accepted Answer · answered Jan 24 '16 at 19:50

144

Modify the open_basedir settings in your hosting account and set them to none. Find the open_basedir setting given under 'PHP Settings' area of your Plesk/cPanel. Set it to 'none' from the dropdown given there. I have shown them in the Plesk panel picture.

answered Jan 24 '16 at 19:50

yogihosting

5,494
8
47
80

2

@yogihosting after doing this i got error - Unable to locate the model you have specified: Home_model – Heemanshu Bhalla Apr 28 '16 at 11:31
1

Bit late to this, but is there a way to do that for all plesk sites? I have it set to none in the global php.ini for the version the sites are using: https://gyazo.com/dfffbe7f9b3a20ede97da72f1ddfc777 But they still get the error. – Matt Cowley Jul 24 '16 at 09:47
@MattCowley you have to do this for each and every site hosted in plesk panel. – yogihosting Jul 27 '16 at 19:31
even I also also followed this answer and started getting error – Saurabh Mar 06 '23 at 14:50

score 40 · Answer 2 · answered Jun 27 '12 at 19:19

40

To resolve this error, you must edit the file httpd.conf. Way before it can be seen in phpinfo in apache2handler section directive Server Root. For example, in my case this way - / etc / httpd / httpd.conf. Open the file httpd.conf, find the mention of the parameter open_basedir. And set it to none. (php_admin_value open_basedir none)

answered Jun 27 '12 at 19:19

Andrei

1,125
2
15
29

1

Setting to 'none' worked for me - using a Plesk interface too. – diggersworld Sep 11 '14 at 13:42
11

I found the `open_basedir` configuration in my `php.ini`. (Arch Linux on Raspberry Pi with php 5) – Dennis van der Schagt Nov 12 '14 at 00:36
2

Also found it in my php.ini (also Arch). Just comment out the line to achieve the same effect as this answer. – Ben Elgar Oct 15 '15 at 16:18
@BenElgar just by commenting the line has mentioned works, i am just asking is there risk there – mwangaben Mar 18 '19 at 02:34

score 13 · Answer 3 · answered Jun 23 '17 at 14:49

13

If you're running this with php file.php. You need to edit php.ini Find this file:

: locate php.ini
/etc/php/php.ini

And append file's path to open_basedir property:

open_basedir = /srv/http/:/home/:/tmp/:/usr/share/pear/:/usr/share/webapps/:/etc/webapps/:/run/media/andrew/ext4/protected

answered Jun 23 '17 at 14:49

deathangel908

8,601
8
47
81

4

This is the only solution that points to multiple specific paths instead of just skipping security altogether. – mvreijn Dec 03 '19 at 09:14

score 7 · Answer 4 · answered Jun 03 '22 at 18:47

7

Laravel

If you have this problem when using Laravel.

Only go to folder bootstrap/cache and rename config.php to anything you want and reload site.

answered Jun 03 '22 at 18:47

Mahdi Bashirpour

17,147
12
117
144

1

This saved me on Laravel 9.4...... today. Thanks a lot! – ERONDU EMMANUEL Dec 25 '22 at 23:37
1

it's the best answer for laravel, thanks a lot – Saeed Mi Mar 27 '23 at 01:51
1

This is crazy, thanks!!! – Alrik Jul 17 '23 at 08:25

score 5 · Answer 5 · edited Jan 15 '13 at 16:19

For me the problem was bad/missing config values for the Plesk server running the whole thing. I just followed the directions here: http://davidseah.com/blog/2007/04/separate-php-error-logs-for-multiple-domains-with-plesk/

You can configure PHP to have a separate error log file for each VirtualHost definition. The trick is knowing exactly how to set it up, because you can’t touch the configuration directly without breaking Plesk. Every domain name on your (dv) has its own directory in /var/www/vhosts. A typical directory has the following top level directories:

cgi-bin/
conf/
error_docs/
httpdocs/
httpsdocs/
...and so on

You’ll want to create a vhost.conf file in the domain directory’s conf/ folder with the following lines:

php_value error_log /path/to/error_log
php_flag display_errors off
php_value error_reporting 6143
php_flag log_errors on

Change the first value to match your actual installation (I used /tmp/phperrors.log). After you’re done editing the vhost.conf file, test the configuration from the console with:

apachectl configtest
…or if you don’t have apachectl (as Plesk 8.6 doesn’t seem to)…

/etc/init.d/httpd configtest

And finally tell Plesk that you’ve made this change.

/usr/local/psa/admin/bin/websrvmng -a

Pavel Kenarov · Answer 6 · 2020-02-16T22:21:29.943

If used ispconfig3:

Go to Website section -> Options -> PHP open_basedir:

In this field has described allowed paths and each path is separated with ":"

/var/www/clients/client2/web3/image:/var/www/clients/client2/web3/web:/var/www/... and so on

So here must put the path that you want to have access, in my case is:

/var/www/clients/client2/web3/image:

The problem appears because:

When a script tries to access the filesystem, for example using include, or fopen(), the location of the file is checked. When the file is outside the specified directory-tree, PHP will refuse to access it.

score 3 · Answer 7 · answered Oct 28 '22 at 07:46

3

For Plesk, you can change or set the openbase dir settings via the panel

https://support.plesk.com/hc/en-us/articles/360006170513-How-to-add-custom-or-additional-path-to-the-open-basedir-option-for-Plesk-domain-

answered Oct 28 '22 at 07:46

Arun Prasad E S

9,489
8
74
87

score 2 · Answer 8 · answered Dec 04 '09 at 13:19

2

The path you're refering to is incorect, and not withing the directoryRoot of your workspace. Try building an absolute path the the file you want to access, where you are now probably using a relative path...

answered Dec 04 '09 at 13:19

NDM

6,731
3
39
52

It's using an absolute path. It works for all users except this one. – Ben Dec 04 '09 at 18:30

score 2 · Answer 9 · edited May 31 '23 at 00:04

2

I had this problem @ one of my wordpress sites after updating and/or moving.

Check in database table 'wp_options' the 'upload_path' and edit it properly...

edited May 31 '23 at 00:04

desertnaut

57,590
26
140
166

answered Sep 14 '17 at 11:47

Bartuzz

829
6
7

what value have you set it to? /[...]/public_html/wp-content/uploads ? – brett Oct 09 '18 at 21:09

score 2 · Answer 10 · answered Jul 12 '21 at 05:08

2

Edit the php.ini or .user.ini that is located within the main directory

open_basedir = none

answered Jul 12 '21 at 05:08

Chaturanga

78
5

score 2 · Answer 11 · edited May 31 '23 at 00:05

2

I had this kind of problem with ispconfig3 and got an error like this

open_basedir restriction in effect. File(/var/www/clients/client7/web15) is not within the allowed path(s):.........

To solve it in my case, I just set PHP to SuPHP in the Website's panel of ispconfig3

edited May 31 '23 at 00:05

desertnaut

57,590
26
140
166

answered Aug 04 '11 at 13:03

Qlimax

5,241
4
28
31

score 0 · Answer 12 · answered Apr 04 '19 at 16:33

If you are running a PHP IIS stack and have this error, it is usually a quick permission fix.

If you administer the windows server yourself and have access, try this FIRST:

Navigate to the folder that is giving you grief on writing to and right click it > open properties > security.

See what users have access to the folder, which ones have read only and which have full. Do you have a group that is blocking write?

The fix will be specific to your IIS setup, are you using Anonymous Authentication with specific user IUSR or with the Application Pool identity?

At any rate, you are going to end up adding a new full write permission for one of IUSR, IIS_IUSRS, or your application pool identity - like I said, this is going to vary depending on your setup and how you want to do it, you can go down the google rabbit hole on this one (one such post - IIS_IUSRS and IUSR permissions in IIS8) For me, i use anon with my app pool identity so i can get away with MACHINE_NAME\IIS_IUSRS with full read/write on any temp or upload folders.

I do not need to add anything extra to my open_basedir = in the php.ini.

score 0 · Answer 13 · answered Aug 06 '19 at 06:57

In addition to @yogihosting's answer, if you are using DirectAdmin, then follow these steps:

Go to the DirectAdmin's login page. Usually, its port is 2222.
Login as administrator. Its username is admin by default.
From the "Access Level" on the right panel, make sure you are on "Admin Level". If not, change to it.
From the "Extra Features" section, click on "Custom HTTPD Configurations".
Choose the domain you want to change.
Enter the configurations you want to change in the textarea at the top of the page. You should consider the existing configuration file and modify values based on it. For example, if you see that open_basedir is set inside a <Directory>, maybe you should surround your change in the related <Directory> tag:
```
<Directory "/path/to/directory">
    php_admin_value open_basedir none
</Directory>
```
After making necessary changes, click on the "Save" button.
You should now see your changes saved to the configuration file if they were valid.

There is another way of editing the configuration file, however:

Caution: Be careful, and use the following steps at your own risk, as you may run into errors, or it may lead to downtime. The recommended way is the previous one, as it prevents you from modifying configuration file improperly and show you the error.

Login to your server as root.
Go to /usr/local/directadmin/data/users. From the listed users, go to one related to the domain you want to change.
Here, there is an httpd.conf file. Make a backup from it:
```
cp httpd.conf httpd.conf.back
```
Now edit the configuration file with your editor of choice. For example, edit existing open_basedir to none. Do not try to remove things, or you may experience downtime. Save the file after editing.
Restart the Apache web server using one of the following ways (use sudo if needed):
```
httpd -k graceful
apachectl -k graceful
apache2 -k graceful
```
If your encounter any errors, then replace the main configuration file with the backed-up file, and restart the web server.

Again, the first solution is the preferred one, and you should not try the second method at the first time. As it is noted in the caution, the advantage of the first way is that it prevents saving your bad-configured stuff.

Hope it helps!

score 0 · Answer 14 · answered Jan 24 '20 at 14:42

I am using an Apache vhost-File to run PHP with application-specific ini-options on my windows-server. Therefore I use the -d option of the php-command.

I am setting the open_basedir for every application as one of these options.

I needed to set multiple urls as open_basedir, including an UNC-Path, and the syntax for this case was a bit hard to find. You have to seperate the paths with semicolons and if your first path starts with a driveletter you might have to start the list with a semicolon too. At least that's what works for me.

Example:

php.exe -d open_basedir=;d:/www/applicationRoot;//internal.unc.path/ressource/

infomasud · Answer 15 · 2021-02-09T09:59:35.087

0

I uploaded my codeigniter project on Directadmin panel. I was getting same error.

Then I change in php settings.

open_basedir = session.save_path = ./temp/

Then it worked for me.

edited Feb 09 '21 at 09:59

answered Feb 08 '21 at 19:06

infomasud

2,263
1
18
12

Dealazer · Answer 16 · 2021-10-05T18:13:06.550

As most do not find a solution, the solutions are broad for WordPress most even don't know fully why things are they are.

I've found out you will have to enable IP for your server in especially when using Cerber in some cases it can think you are not uploading .png instead you are uploading .js files.

The server IP needs to be whitelisted. Even the uploaders in some rare cases.

A great to know is to have a tmp folder 755 in your base directory, you actually do not need a folder called tmp.: "Also remember / properly inedited as below:

open_basedir = "/home/user/site.com/:/tmp"
upload_tmp_dir = /home/user/site.com/tmp

The best option for quick setup is in Cpanel where you use the MultiPHP INI Editor you can actually save and both .htaccess and php.ini will be updated as well as settings being initiated at the same time on site.

It's NOT recommended to have basedir as "none" since you are enabling root files that can be edited with just a single file editor in WordPress. If that truly is possible.

score 0 · Answer 17 · answered May 28 '23 at 03:59

0

For me it is because I gave the wrong path in the tmp directory of php.

Hope this helps

answered May 28 '23 at 03:59

Jom Apps

1
1

score -1 · Answer 18 · answered Jan 12 '21 at 12:20

-1

Check \httpdocs\bootstrap\cache\config.php file in plesk to see if there are some unwanted paths.

answered Jan 12 '21 at 12:20

Menachem Segal

1
2

score -3 · Answer 19 · answered Aug 09 '18 at 08:21

-3

Just search

open_basedir =

in php.ini and disable it. That's the simplest solution to solve this issue.

Before Changes open_basedir =

After Changes ;open_basedir =

P.s - After changes don't forget to restart your server.

Enjoy ;)

answered Aug 09 '18 at 08:21

Lalit Giriya

312
1
9

4

don't do this... security is, believe it or not, *important.* :) Time to read docs on your tools: http://php.net/manual/en/ini.core.php#ini.open-basedir – Adam Lenda Dec 17 '18 at 15:49

score -29 · Answer 20 · edited Oct 07 '12 at 19:18

-29

Modify the open_basedir settings in your PHP configuration (See Runtime Configuration).

The open_basedir setting is primarily used to prevent PHP scripts for a particular user from accessing files in another user's account. So usually, any files in your own account should be readable by your own scripts.

Example settings via .htaccess if PHP runs as Apache module on a Linux system:

<DirectoryMatch "/home/sites/site81/">
    php_admin_value open_basedir "/home/sites/site81/:/tmp/:/"
</DirectoryMatch>

edited Oct 07 '12 at 19:18

hakre

193,403
52
435
836

answered May 26 '10 at 20:15

Nikesh

359
3
3

This was useful for me when I copied some files from a centos server to my local development osx machine. – Aspelund Jan 12 '12 at 02:16
3

@Nikesh This gave me a 500 error after I dropped it into my .htaccces and changed the paths to: `/my/cutsom/dir/`. Not sure why thought. – hitautodestruct Jan 24 '13 at 17:06
83

Cool, 12 upvotes so far for an incorrect answer. [You cannot use `php_admin_value` in `.htaccess` files](http://php.net/manual/en/configuration.changes.php). [You cannot use DirectoryMatch in .htaccess files](http://httpd.apache.org/docs/2.4/en/mod/core.html#directorymatch). (What kind of security measure would `open_basedir` be if it could just be disabled?) – Álvaro González Apr 24 '13 at 15:05
@ÁlvaroG.Vicario Do you have a solution, in that case? – eoinoc Jun 17 '13 at 09:53
1

@eoinoc - Scroll down and see e.g. Andrei's answer. Or edit global php.ini file. – Álvaro González Jun 17 '13 at 11:06
21

YOU DO NOT PUT THIS INTO YOUR HTACCESS! BUT RATHER INTO YOUR APACHE CONFIG FILE. – tfont Aug 23 '13 at 20:00
10

Including the root directory in open_basedir defeats the purpose of open_basedir entirely. This solution only "works" in the sense that it essentially disables the restriction. – Martin Oct 16 '13 at 21:20
the `:/` is important – Patrioticcow May 01 '14 at 17:02
This Just Doesn't work. adding above code to .htaccess gives 500 error. – Chakri Jun 26 '14 at 17:17
@ÁlvaroG.Vicario That depends on how the web server is configured. On some servers you can. – RobinJ Aug 25 '14 at 18:49
I have sample problem with Yii 2 Framewor, that error http://prntscr.com/gcu17k . so how can i fix it. – dungphanxuan Aug 25 '17 at 09:13
allow root dir it is a worst idea ever! – Urgotto Oct 26 '18 at 11:56
2

Downvoting an answer that shows working config file syntax while upvoting a shared hosters web gui screenshot. Only true php developers could do this. – ohcibi Oct 31 '18 at 09:39

open_basedir restriction in effect. File(/) is not within the allowed path(s):

20 Answers20

Laravel

Linked

Related