nextcloud / nextcloud/contacts

file_exists(): open_basedir restriction in effect. File(/files) is not within the allowed path(s)

Open
#3,019 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

0. Needs triage bug feature: contacts
Dominant language
JavaScript
Stars
642
Forks
220
Avg merge
14h 39m
Merged PRs (30d)
51

Description

Describe the bug

It looks like the tree is not complete so the file_exists call is wrong:

File (/files) is not within the allowed path(s)

{
    "file": "/nextcloud/apps/contacts/lib/Dav/PatchPlugin.php",
    "line": 73,
    "function": "nodeExists",
    "class": "Sabre\\DAV\\Tree",
    "type": "->",
    "args": [
      "files/user/SAM/MARCHES 2021/DAE AMOE/FE_AMOE_2021_lot_9-V0.docx"
    ]
},

Full:

{
  "reqId": "oID6zwGuA53b05L6SeHD",
  "level": 3,
  "time": "2022-10-05T12:30:06+02:00",
  "remoteAddr": "138.195.208.52",
  "user": "--",
  "app": "PHP",
  "method": "HEAD",
  "url": "/remote.php/dav/files/user/SAM/MARCHES%202021/DAE%20AMOE/FE_AMOE_2021_lot_9-V0.docx",
  "message": "file_exists(): open_basedir restriction in effect. File(/files) is not within the allowed path(s): (/nextcloud:/dev/urandom) at /nextcloud/3rdparty/sabre/dav/lib/DAV/FS/Directory.php#78",
  "userAgent": "Microsoft Office Existence Discovery",
  "version": "23.0.9.1",
  "exception": {
    "Exception": "Error",
    "Message": "file_exists(): open_basedir restriction in effect. File(/files) is not within the allowed path(s): (/nextcloud:/dev/urandom) at /nextcloud/3rdparty/sabre/dav/lib/DAV/FS/Directory.php#78",
    "Code": 0,
    "Trace": [
      {
        "function": "onError",
        "class": "OC\\Log\\ErrorHandler",
        "type": "::",
        "args": [
          2,
          "file_exists(): open_basedir restriction in effect. File(/files) is not within the allowed path(s): (/nextcloud:/dev/urandom)",
          "/nextcloud/3rdparty/sabre/dav/lib/DAV/FS/Directory.php",
          78
        ]
      },
      {
        "file": "/nextcloud/3rdparty/sabre/dav/lib/DAV/FS/Directory.php",
        "line": 78,
        "function": "file_exists",
        "args": [
          "/files"
        ]
      },
      {
        "file": "/nextcloud/3rdparty/sabre/dav/lib/DAV/Tree.php",
        "line": 70,
        "function": "getChild",
        "class": "Sabre\\DAV\\FS\\Directory",
        "type": "->",
        "args": [
          "files"
        ]
      },
      {
        "file": "/nextcloud/3rdparty/sabre/dav/lib/DAV/Tree.php",
        "line": 73,
        "function": "getNodeForPath",
        "class": "Sabre\\DAV\\Tree",
        "type": "->",
        "args": [
          "files"
        ]
      },
      {
        "file": "/nextcloud/3rdparty/sabre/dav/lib/DAV/Tree.php",
        "line": 73,
        "function": "getNodeForPath",
        "class": "Sabre\\DAV\\Tree",
        "type": "->",
        "args": [
          "files/user"
        ]
      },
      {
        "file": "/nextcloud/3rdparty/sabre/dav/lib/DAV/Tree.php",
        "line": 73,
        "function": "getNodeForPath",
        "class": "Sabre\\DAV\\Tree",
        "type": "->",
        "args": [
          "files/user/SAM"
        ]
      },
      {
        "file": "/nextcloud/3rdparty/sabre/dav/lib/DAV/Tree.php",
        "line": 73,
        "function": "getNodeForPath",
        "class": "Sabre\\DAV\\Tree",
        "type": "->",
        "args": [
          "files/user/SAM/MARCHES 2021"
        ]
      },
      {
        "file": "/nextcloud/3rdparty/sabre/dav/lib/DAV/Tree.php",
        "line": 106,
        "function": "getNodeForPath",
        "class": "Sabre\\DAV\\Tree",
        "type": "->",
        "args": [
          "files/user/SAM/MARCHES 2021/DAE AMOE"
        ]
      },
      {
        "file": "/nextcloud/apps/contacts/lib/Dav/PatchPlugin.php",
        "line": 73,
        "function": "nodeExists",
        "class": "Sabre\\DAV\\Tree",
        "type": "->",
        "args": [
          "files/user/SAM/MARCHES 2021/DAE AMOE/FE_AMOE_2021_lot_9-V0.docx"
        ]
      },
      {
        "file": "/nextcloud/3rdparty/sabre/dav/lib/DAV/Server.php",
        "line": 528,
        "function": "getHTTPMethods",
        "class": "OCA\\Contacts\\Dav\\PatchPlugin",
        "type": "->",
        "args": [
          "files/user/SAM/MARCHES 2021/DAE AMOE/FE_AMOE_2021_lot_9-V0.docx"
        ]
      },
      {
        "file": "/nextcloud/3rdparty/sabre/dav/lib/DAV/CorePlugin.php",
        "line": 212,
        "function": "getAllowedMethods",
        "class": "Sabre\\DAV\\Server",
        "type": "->",
        "args": [
          "files/user/SAM/MARCHES 2021/DAE AMOE/FE_AMOE_2021_lot_9-V0.docx"
        ]
      },
      {
        "file": "/nextcloud/apps/dav/lib/Connector/Sabre/AnonymousOptionsPlugin.php",
        "line": 76,
        "function": "httpOptions",
        "class": "Sabre\\DAV\\CorePlugin",
        "type": "->",
        "args": [
          {
            "__class__": "Sabre\\HTTP\\Request"
          },
          {
            "__class__": "Sabre\\HTTP\\Response"
          }
        ]
      },
      {
        "file": "/nextcloud/3rdparty/sabre/event/lib/WildcardEmitterTrait.php",
        "line": 89,
        "function": "handleAnonymousOptions",
        "class": "OCA\\DAV\\Connector\\Sabre\\AnonymousOptionsPlugin",
        "type": "->",
        "args": [
          {
            "__class__": "Sabre\\HTTP\\Request"
          },
          {
            "__class__": "Sabre\\HTTP\\Response"
          }
        ]
      },
      {
        "file": "/nextcloud/3rdparty/sabre/dav/lib/DAV/Server.php",
        "line": 456,
        "function": "emit",
        "class": "Sabre\\DAV\\Server",
        "type": "->",
        "args": [
          "beforeMethod:HEAD",
          [
            {
              "__class__": "Sabre\\HTTP\\Request"
            },
            {
              "__class__": "Sabre\\HTTP\\Response"
            }
          ]
        ]
      },
      {
        "file": "/nextcloud/3rdparty/sabre/dav/lib/DAV/Server.php",
        "line": 253,
        "function": "invokeMethod",
        "class": "Sabre\\DAV\\Server",
        "type": "->",
        "args": [
          {
            "__class__": "Sabre\\HTTP\\Request"
          },
          {
            "__class__": "Sabre\\HTTP\\Response"
          }
        ]
      },
      {
        "file": "/nextcloud/3rdparty/sabre/dav/lib/DAV/Server.php",
        "line": 321,
        "function": "start",
        "class": "Sabre\\DAV\\Server",
        "type": "->",
        "args": []
      },
      {
        "file": "/nextcloud/apps/dav/lib/Server.php",
        "line": 339,
        "function": "exec",
        "class": "Sabre\\DAV\\Server",
        "type": "->",
        "args": []
      },
      {
        "file": "/nextcloud/apps/dav/appinfo/v2/remote.php",
        "line": 35,
        "function": "exec",
        "class": "OCA\\DAV\\Server",
        "type": "->",
        "args": []
      },
      {
        "file": "/nextcloud/remote.php",
        "line": 166,
        "args": [
          "/nextcloud/apps/dav/appinfo/v2/remote.php"
        ],
        "function": "require_once"
      }
    ],
    "File": "/nextcloud/lib/private/Log/ErrorHandler.php",
    "Line": 92,
    "CustomMessage": "--"
  },
  "id": "633d6bba0b86d"
}
Steps to reproduce

Windows 10 WebDAV access.

Expected behavior

Correct server tree.

Actual behavior

Wrong server tree, resulting in open_basedir error.

Contact version

4.2.2

Operating system

No response

PHP engine version

PHP 8.0

Web server

Apache (supported)

Database

MariaDB

Additional info

No response

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with apps/contacts/lib/Dav/PatchPlugin.php at line 73 and trace the supplied call into 3rdparty/sabre/dav/lib/DAV/Tree.php and DAV/FS/Directory.php at line 78. Reproduce the Windows 10 WebDAV request with PHP 8.0, then verify that the server tree is resolved correctly without the open_basedir error.

Written by the indexing model from the issue text.

Assessment

Tech stack
apache, mariadb, php
Domain
api, backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.