H
H
Herman Martin2018-03-06 16:31:49
PHP
Herman Martin, 2018-03-06 16:31:49

How to bypass open_basedir restriction in effect. File(php://output)?

Good afternoon.
Using PHPExcel, an xlsx document is generated. View generation:

// ...
        $filename = sha1(md5((new DateTime())->format('r') ) . Yii::$app->params['file_export_salt'] ) . '.xlsx';        
        header ('Expires: Mon, 26 Jul 1997 05:00:00 GMT'); // Date in the past
        header ('Last-Modified: '.gmdate('D, d M Y H:i:s').' GMT'); // always modified
        header ('Cache-Control: cache, must-revalidate'); // HTTP/1.1
        header ('Pragma: public'); // HTTP/1.0

        $objWriter = PHPExcel_IOFactory::createWriter($objPHPExcel, 'OpenDocument');
        $objWriter->save('php://output');
        exit;

part of the config responsible for the current host:
<VirtualHost *:85>
    ServerAdmin [email protected]
    DocumentRoot "/SRV/vhosts/myev.loc/html/web"
    ServerName myev.loc
    ServerAlias www.myev.loc
        # 1
  php_admin_value open_basedir "/SRV/vhosts/myev.loc/html/"
        # 2
  php_admin_value upload_tmp_dir "/SRV/vhosts/myev.loc/html/web/upload_tmp_dir"
    ErrorLog "/SRV/vhosts/myev.loc/logs/error.log"
    CustomLog "/SRV/vhosts/myev.loc/logs/access.log" common
</VirtualHost>

If you remove the line under #1, the task is solved, but this is not good, then the user will be able to walk through the folders of other users. How to whitelist php://output? Or another solution.
I tried changing and/or adding commands like #1, #2 to htaccess, but it didn't help.

Answer the question

In order to leave comments, you need to log in

2 answer(s)
S
synapse_people, 2018-03-06
@dklight

For Apache there is suexec, apache-mpm-itk and some other third module was
Take them

O
Optimus, 2018-03-06
Pyan @marrk2

php_admin_value open_basedir none

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question