[BUGS-6318] file_exists(): open_basedir restriction in effect.

[hj-collab]

Hi,

I have implemented an open_basedir restriction in my PHP configuration to prevent PHP execution outside of the "/var/www/html/" directory. However, I am perplexed as to why the object cache is attempting to access the sock file as if it were a PHP file.

Warning: file_exists(): open_basedir restriction in effect. File(/var/run/redis/redis.sock) is not within the allowed path(s): (/var/www/html/) in /var/www/html/wp-content/object-cache.php on line 1259

Warning: Redis::connect(): php_network_getaddresses: getaddrinfo for /var/run/redis/redis.sock failed: Name or service not known in /var/www/html/wp-content/object-cache.php on line 1291

Warning: WP Redis: php_network_getaddresses: getaddrinfo for /var/run/redis/redis.sock failed: Name or service not known in /var/www/html/wp-content/object-cache.php on line 1475

[kporras07]

Hi!
Thanks for reporting this.

Could you please provide steps to reproduce? (i.e. how is your redis setup and host configuration, what do you do to get the warning, etc)

Thanks!

[hj-collab]

Hi,

Thanks for getting back to me. I am using the default Redis configuration with unix socket instead of tcp. The only change I made is in the php.ini file, where I have set an opendir_base redirection.

open_basedir = /var/www/html/

PHP files won't execute outside of this directory as per this restriction set. I am not facing the same issue with the Redis Cache plugin available at https://wordpress.org/plugins/redis-cache/.

Best regards,

[hj-collab]

Hi Kevin,

I have implemented a temporary solution to enable PHP files to access the Redis Unix socket. However, I am not satisfied with this approach as I believe it compromises security. Could you please review @tillkruss object cache file (https://github.com/rhubarbgroup/redis-cache/blob/develop/includes/object-cache.php) and observe how he manages to access the Unix socket without requiring any bypass to the open_basedir protection?

Temporary solution:
php_value[open_basedir] = /var/www/html/:/var/run/redis/

[hj-collab]

@kporras07 The issue is solved if, instead of looking for the file, we look for the Unix socket.

Current:
if ( file_exists( $redis_server['host'] ) && 'socket' === filetype( $redis_server['host'] ) ) { // unix socket connection.

Suggested:
if (strpos($redis_server['host'], 'unix:///') === 0) { // Unix socket connection.

Then defining the following in the wp-config.php file

// Redis
 $redis_server = array(
     'host'     => 'unix:///var/run/redis/redis.sock',
     'port'     => null,
 );

What do you think?

[kporras07]

@hj-collab thanks! That's a lot of useful info. I created an internal ticket and will be adding this info there and pass this along to the team that works on this plugin.

Internal ticket: BUGS-6318

Thanks!

[tillkruss]

Is there anything I can contribute here?

[hj-collab]

@kporras07 Thanks Kevin!

@tillkruss Can you please check if my suggested solution is the way to go? Because it won't work unless they specify unix:/// in the file path for socket. Pantheon will have to update the documentation to reflect the same.

// Redis
 $redis_server = array(
     'host'     => 'unix:///var/run/redis/redis.sock',
     'port'     => null,
 );

[tillkruss]

@hj-collab Using WP Redis or using Redis Object Cache?

[hj-collab]

@tillkruss I am using WP Redis.

@pwtyler I noticed that you pushed the pull request related to this issue. You will also need to update the documentation to use a sock URL with unix:/// in it. It won't work otherwise.