Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Essentially i found out you can prevent one site which has a security hole from modifying/reading another site via "open_basedir".

However when i upload media files using wordpress i got the error

[error] 3048#0: *42070 FastCGI sent in stderr: "PHP Warning:  file_exists(): open_basedir restriction in effect. File(/tmp/php51UUIj) is not within the allowed path(s): (/var/www/wordpress-site) in /var/www/wordpress-site/wp-includes/functions.php on line 2505
PHP Warning:  file_exists(): open_basedir restriction in effect. File(/tmp//TheFile.tmp) is not within the allowed path(s): (/var/www/wordpress-site) in /var/www/wordpress-site/wp-includes/functions.php on line 2340
PHP Warning:  touch(): open_basedir restriction in effect. File(/tmp/TheFile.tmp) is not within the allowed path(s): (/var/www/wordpress-site) in /var/www/wordpress-site/wp-admin/includes/file.php on line 177" while reading response header from upstream, client:, server:, request: "POST /wp-admin/async-upload.php HTTP/1.1", upstream: "fastcgi://unix:/var/run/php-fastcgi/php-fcgi.socket:", host: "", referrer: ""

Removing this line from nginx fixed it

fastcgi_param  PHP_VALUE            open_basedir=$document_root;

However thats because open_basedir is disabled and now a hole in one site can access data in another. Is it possible to have open_basedir and allow wordpress to move /tmp/somefile into its own site directory?

share|improve this question
up vote 1 down vote accepted

This is very direct, but explains it pretty good: open_basedir is like peeing your pants to stay warm.

Yes, it prevents functions like file_get_contents and such from accessing anything outside the desired directory. But then I could just use exec("cat /etc/passwd", $res); or some of the other functions that does similar things.

But, to answer your question, the way one does this in PHP is by adding the folders allowed separated by colon. E.g.

share|improve this answer
Nice. I wrote fastcgi_param PHP_VALUE open_basedir="$document_root:/tmp"; and it worked – acidzombie24 Jan 27 '12 at 23:32

Give wordpress a temp directory within the docroot /var/www/wordpress-site and make it use that.

Do not add /tmp/ to the list of allowed directories - that would be unsafe.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.