<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>潘锦的空间 &#187; 安全隐患</title>
	<atom:link href="https://www.phppan.com/tag/%e5%ae%89%e5%85%a8%e9%9a%90%e6%82%a3/feed/" rel="self" type="application/rss+xml" />
	<link>https://www.phppan.com</link>
	<description>SaaS SaaS架构 团队管理 技术管理 技术架构 PHP 内核 扩展 项目管理</description>
	<lastBuildDate>Sat, 25 Apr 2026 00:56:17 +0000</lastBuildDate>
	<language>zh-CN</language>
		<sy:updatePeriod>hourly</sy:updatePeriod>
		<sy:updateFrequency>1</sy:updateFrequency>
	<generator>https://wordpress.org/?v=3.9.40</generator>
	<item>
		<title>php.ini的open_basedir参数设置与PHP文件操作存在的安全隐患</title>
		<link>https://www.phppan.com/2009/10/php-ini-open_basedir/</link>
		<comments>https://www.phppan.com/2009/10/php-ini-open_basedir/#comments</comments>
		<pubDate>Sat, 31 Oct 2009 14:02:38 +0000</pubDate>
		<dc:creator><![CDATA[admin]]></dc:creator>
				<category><![CDATA[PHP]]></category>
		<category><![CDATA[php.ini]]></category>
		<category><![CDATA[安全隐患]]></category>
		<category><![CDATA[文件操作]]></category>

		<guid isPermaLink="false">http://www.phppan.com/?p=294</guid>
		<description><![CDATA[【php.ini中的open_basedir参数】 如果设置了open_basedir参数为一组目录列表，则P [&#8230;]]]></description>
				<content:encoded><![CDATA[<p>【php.ini中的open_basedir参数】<br />
如果设置了open_basedir参数为一组目录列表，则PHP只能操作此组目录列表下的所有文件(包括文件自身)。 当一个脚本试图打开一个指定目录树之外的文件时，将遭到拒绝。所有的符号连接都会被解析，所以不可能通过符号连接来避开此限制。</p>
<p>特殊值&#8217;.&#8217;指定了存放该脚本的目录将被当做基准目录，但这有些危险，因为脚本的工作目录可以轻易被chdir()改变。</p>
<p>对于共享服务器，在httpd.conf中针对不同的虚拟主机或目录灵活设置该指令将变得非常有用。<br />
在Windows中用分号分隔目录，UNIX系统中用冒号分隔目录。</p>
<p>作为Apache模块时，父目录中的open_basedir路径将自动被继承。<br />
指定的限制实际上是一个前缀，而非一个目录名，也就是说&#8221;/dir/incl&#8221;将允许访问&#8221;/dir/include&#8221;和&#8221;/dir/incls&#8221;，如果您希望将访问控制在一个指定的目录，那么请在结尾加上一个斜线。<br />
默认是允许打开所有文件。<br />
另外，在PHP6中将使用基于open_basedir的安全防护。<br />
另外，dl()函数可以绕过open_basedir指令的限制。</p>
<p>【不对此进行设置可能存在的问题】<br />
将如下代码放到所在服务器，如果没有设置此参数，则可能会列出服务器的所有文件目录，让人看到自己服务器的所有信息貌似并不是一件很爽的事情。</p>

<div class="wp_syntax"><table><tr><td class="line_numbers"><pre>1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
</pre></td><td class="code"><pre class="php" style="font-family:monospace;"><span style="color: #000000; font-weight: bold;">&lt;?php</span>
<span style="color: #009933; font-style: italic;">/**
 * 遍历所在服务器的所有文件
 * 基于php.ini配置中的open_basedir设置，如果此设置设置了相关路径，则只能浏览此目录下的文件
 * @param 当前目录的上level级目录，显示此目录下的所有文件 ，如果有的话
 * @example http://localhost/index.php?level=1  当前目录的上一级目录下的所有文件
 */</span>
<span style="color: #990000;">header</span><span style="color: #009900;">&#40;</span><span style="color: #0000ff;">&quot;Content-type: text/htmlcharset=utf-8&quot;</span><span style="color: #009900;">&#41;</span>
&nbsp;
<span style="color: #000088;">$filepath</span> <span style="color: #339933;">=</span> <span style="color: #000088;">$_SERVER</span><span style="color: #009900;">&#91;</span><span style="color: #0000ff;">'DOCUMENT_ROOT'</span><span style="color: #009900;">&#93;</span> <span style="color: #339933;">.</span> <span style="color: #0000ff;">&quot;/&quot;</span>
<span style="color: #000088;">$dir_array</span> <span style="color: #339933;">=</span> <span style="color: #990000;">array</span><span style="color: #009900;">&#40;</span><span style="color: #009900;">&#41;</span>
<span style="color: #b1b100;">while</span> <span style="color: #009900;">&#40;</span><span style="color: #009900; font-weight: bold;">true</span><span style="color: #009900;">&#41;</span> <span style="color: #009900;">&#123;</span>
    <span style="color: #000088;">$dir_array</span><span style="color: #009900;">&#91;</span><span style="color: #009900;">&#93;</span> <span style="color: #339933;">=</span> <span style="color: #000088;">$filepath</span>
    <span style="color: #b1b100;">if</span> <span style="color: #009900;">&#40;</span><span style="color: #339933;">!</span><span style="color: #990000;">is_dir</span><span style="color: #009900;">&#40;</span><span style="color: #000088;">$filepath</span><span style="color: #009900;">&#41;</span><span style="color: #009900;">&#41;</span> <span style="color: #009900;">&#123;</span>
        <span style="color: #b1b100;">break</span>
    <span style="color: #009900;">&#125;</span>
    <span style="color: #000088;">$filepath</span> <span style="color: #339933;">=</span> <span style="color: #990000;">realpath</span><span style="color: #009900;">&#40;</span><span style="color: #000088;">$filepath</span><span style="color: #339933;">.</span><span style="color: #0000ff;">&quot;../&quot;</span><span style="color: #009900;">&#41;</span>
<span style="color: #009900;">&#125;</span>
&nbsp;
<span style="color: #990000;">print_r</span><span style="color: #009900;">&#40;</span><span style="color: #000088;">$dir_array</span><span style="color: #009900;">&#41;</span>
&nbsp;
<span style="color: #000088;">$level</span> <span style="color: #339933;">=</span> <span style="color: #000088;">$_GET</span><span style="color: #009900;">&#91;</span><span style="color: #0000ff;">'level'</span><span style="color: #009900;">&#93;</span>
&nbsp;
&nbsp;
<span style="color: #b1b100;">if</span> <span style="color: #009900;">&#40;</span><span style="color: #990000;">isset</span><span style="color: #009900;">&#40;</span><span style="color: #000088;">$level</span><span style="color: #009900;">&#41;</span><span style="color: #009900;">&#41;</span> <span style="color: #009900;">&#123;</span>    <span style="color: #666666; font-style: italic;">//  遍历当前目录的上level级下的所有文件</span>
    <span style="color: #b1b100;">if</span> <span style="color: #009900;">&#40;</span><span style="color: #990000;">isset</span><span style="color: #009900;">&#40;</span><span style="color: #000088;">$dir_array</span><span style="color: #009900;">&#91;</span><span style="color: #000088;">$level</span><span style="color: #009900;">&#93;</span><span style="color: #009900;">&#41;</span><span style="color: #009900;">&#41;</span> <span style="color: #009900;">&#123;</span>
        <span style="color: #000088;">$files</span> <span style="color: #339933;">=</span> get_files<span style="color: #009900;">&#40;</span><span style="color: #000088;">$dir_array</span><span style="color: #009900;">&#91;</span><span style="color: #000088;">$level</span><span style="color: #009900;">&#93;</span><span style="color: #009900;">&#41;</span>
        <span style="color: #990000;">print_r</span><span style="color: #009900;">&#40;</span><span style="color: #000088;">$files</span><span style="color: #009900;">&#41;</span>
    <span style="color: #009900;">&#125;</span><span style="color: #b1b100;">else</span><span style="color: #009900;">&#123;</span>
        <span style="color: #b1b100;">echo</span> <span style="color: #0000ff;">'不存在此目录!'</span><span style="color: #339933;">,</span> <span style="color: #0000ff;">'&lt;br /&gt;'</span>
    <span style="color: #009900;">&#125;</span>
&nbsp;
<span style="color: #009900;">&#125;</span><span style="color: #b1b100;">else</span> <span style="color: #009900;">&#123;</span>  <span style="color: #666666; font-style: italic;">//  所有文件</span>
    <span style="color: #b1b100;">foreach</span> <span style="color: #009900;">&#40;</span><span style="color: #000088;">$dir_array</span> <span style="color: #b1b100;">as</span> <span style="color: #000088;">$dir</span><span style="color: #009900;">&#41;</span> <span style="color: #009900;">&#123;</span>
        <span style="color: #000088;">$files</span> <span style="color: #339933;">=</span> get_files<span style="color: #009900;">&#40;</span><span style="color: #000088;">$dir</span><span style="color: #009900;">&#41;</span>
        <span style="color: #990000;">print_r</span><span style="color: #009900;">&#40;</span><span style="color: #000088;">$files</span><span style="color: #009900;">&#41;</span>
    <span style="color: #009900;">&#125;</span>
<span style="color: #009900;">&#125;</span>
&nbsp;
<span style="color: #990000;">die</span><span style="color: #009900;">&#40;</span><span style="color: #009900;">&#41;</span>
&nbsp;
&nbsp;
<span style="color: #000000; font-weight: bold;">function</span> get_files<span style="color: #009900;">&#40;</span><span style="color: #000088;">$dir</span><span style="color: #009900;">&#41;</span> <span style="color: #009900;">&#123;</span>
    <span style="color: #000088;">$dir</span> <span style="color: #339933;">=</span> <span style="color: #990000;">realpath</span><span style="color: #009900;">&#40;</span><span style="color: #000088;">$dir</span><span style="color: #009900;">&#41;</span> <span style="color: #339933;">.</span> <span style="color: #0000ff;">&quot;/&quot;</span>
    <span style="color: #000088;">$files</span>  <span style="color: #339933;">=</span> <span style="color: #990000;">array</span><span style="color: #009900;">&#40;</span><span style="color: #009900;">&#41;</span>
    <span style="color: #b1b100;">if</span> <span style="color: #009900;">&#40;</span><span style="color: #339933;">!</span><span style="color: #990000;">is_dir</span><span style="color: #009900;">&#40;</span><span style="color: #000088;">$dir</span><span style="color: #009900;">&#41;</span><span style="color: #009900;">&#41;</span> <span style="color: #009900;">&#123;</span>
        <span style="color: #b1b100;">return</span> <span style="color: #000088;">$files</span>
    <span style="color: #009900;">&#125;</span>
&nbsp;
    <span style="color: #000088;">$pattern</span> <span style="color: #339933;">=</span>  <span style="color: #000088;">$dir</span> <span style="color: #339933;">.</span> <span style="color: #0000ff;">&quot;*&quot;</span>
    <span style="color: #000088;">$file_arr</span> <span style="color: #339933;">=</span> <span style="color: #990000;">glob</span><span style="color: #009900;">&#40;</span><span style="color: #000088;">$pattern</span><span style="color: #009900;">&#41;</span>
    <span style="color: #b1b100;">foreach</span> <span style="color: #009900;">&#40;</span><span style="color: #000088;">$file_arr</span> <span style="color: #b1b100;">as</span> <span style="color: #000088;">$file</span><span style="color: #009900;">&#41;</span> <span style="color: #009900;">&#123;</span>
        <span style="color: #b1b100;">if</span> <span style="color: #009900;">&#40;</span><span style="color: #990000;">is_dir</span><span style="color: #009900;">&#40;</span><span style="color: #000088;">$file</span><span style="color: #009900;">&#41;</span><span style="color: #009900;">&#41;</span> <span style="color: #009900;">&#123;</span>
            <span style="color: #000088;">$temp</span> <span style="color: #339933;">=</span> get_files<span style="color: #009900;">&#40;</span><span style="color: #000088;">$file</span><span style="color: #009900;">&#41;</span>
            <span style="color: #b1b100;">if</span> <span style="color: #009900;">&#40;</span><span style="color: #990000;">is_array</span><span style="color: #009900;">&#40;</span><span style="color: #000088;">$temp</span><span style="color: #009900;">&#41;</span><span style="color: #009900;">&#41;</span> <span style="color: #009900;">&#123;</span>
                <span style="color: #000088;">$files</span> <span style="color: #339933;">=</span> <span style="color: #990000;">array_merge</span><span style="color: #009900;">&#40;</span><span style="color: #000088;">$files</span><span style="color: #339933;">,</span> <span style="color: #000088;">$temp</span><span style="color: #009900;">&#41;</span>
            <span style="color: #009900;">&#125;</span>
        <span style="color: #009900;">&#125;</span><span style="color: #b1b100;">else</span> <span style="color: #009900;">&#123;</span>
            <span style="color: #000088;">$files</span><span style="color: #009900;">&#91;</span><span style="color: #009900;">&#93;</span> <span style="color: #339933;">=</span> <span style="color: #000088;">$file</span>
        <span style="color: #009900;">&#125;</span>
    <span style="color: #009900;">&#125;</span>
    <span style="color: #b1b100;">return</span> <span style="color: #000088;">$files</span>
<span style="color: #009900;">&#125;</span>
<span style="color: #000000; font-weight: bold;">?&gt;</span></pre></td></tr></table></div>

<p>【严重问题】<br />
如果用户有正常的FTP账号，使用FTP创建文件，并copy到服务器的其它目录，并执行该程序，也许后果不堪设想！谨记！</p>
]]></content:encoded>
			<wfw:commentRss>https://www.phppan.com/2009/10/php-ini-open_basedir/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>
