Page 1 of 1

open_basedir error although the correct path is set

Posted: 10 Dec 2019, 10:56
by ulfklose
I just tried to install X3 on my shared hosting (netcup, Germany).

This is the error message:

Code
PHP session.save-path directory is blocked by open_basedir. Your server session.save_path is set to /var/lib/php/sessions but this directory is not within your open_basedir allowed paths. If you can't login to your X3 panel, it means X3 can't save the login-session, in which case you need to contact your host.
And this is actually the case: I can't login.

This is my open_basedir variable (local value AND master value) according to phpinfo().

Code
/var/www/vhosts/hostingxxxxxx.asdf.netcup.net/httpdocs/domain.tld/:/tmp/:/var/lib/php5/sessions:/var/lib/php/sessions:/var/www/vhosts/hostingxxxxxx.asdf.netcup.net/tmp
I'm on PHP 7.4 but also tried 7.1, 7.2 and 7.3.

My hosting provider allows two different settings for the open_basedir variable, I tried both. Both contain /var/lib/php/sessions thus this shouldn't be a problem.

Is this a bug?

Re: open_basedir error although the correct path is set

Posted: 10 Dec 2019, 23:47
by mjau-mjau
Sometimes the session-warning from the X3 diagnostics page could be mistaken,  but in the case where you can't actually login, it's very likely that there is some flaw with your PHP sessions (maybe related to open_basedir, but not necessarily). When you LOGIN from the panel, X3 will simply use PHP session() function, and if the login is correct but the session storage is not working, it will simply return to the login page.

What exactly happens when you try to login? Do you see a warning "incorrect login" or does it just show the login page again with no warning? Do you have a link for me to check? I can only diagnose properly if I can check myself.
ulfklose wrote:
Code
/var/www/vhosts/hostingxxxxxx.asdf.netcup.net/httpdocs/domain.tld/:/tmp/:/var/lib/php5/sessions:/var/lib/php/sessions:/var/www/vhosts/hostingxxxxxx.asdf.netcup.net/tmp
It could be diagnostics is wrong, and it could be open_basedir has nothing to do with the issue. From my experience, it's normally related to PHP session() (unless you are missing a PHP extension, but you would see that in diagnostics). One issue I noticed a few servers have had, is that session() was not persistent (across pages) ... Which means that even after successful login, the next page does not remember the login, and instead redirects back to the login page, without any warnings.
ulfklose wrote:I'm on PHP 7.4 but also tried 7.1, 7.2 and 7.3.
It's defintely not related to PHP version specifically. Likely your host has similar options configured across multiple PHP versions.
ulfklose wrote:My hosting provider allows two different settings for the open_basedir variable, I tried both. Both contain /var/lib/php/sessions thus this shouldn't be a problem.
Yes, it might be entirely unrelated to open_basedir.

The ultimate check is to see if PHP sessions() are working properly (persistently) on your server, which I suspect is not the case. Any application with login mechansim will require PHP sessions to work correctly. I would probably need FTP login to accurately be able to verify PHP sessions.

Re: open_basedir error although the correct path is set

Posted: 11 Dec 2019, 09:20
by ulfklose
Thank you for your reply. I managed to resolve that issue with the help of my hosting provider. They offer two different paths, the second one worked. I tried that before but I guess I didn't wait long enough for the changes to actually apply.