Is_file(): open_basedir restriction in effect

Nextcloud version (eg, 20.0.5): 28.0.4
Operating system and version (eg, Ubuntu 20.04): webhosting package
Apache or nginx version (eg, Apache 2.4.25): webhosting package
PHP version (eg, 7.4): 8.2.16

The issue you are facing:

Hi. I think something is messed up with the directories. Random / appear and one ist missing between httpdodcs and app. Nothin changed at my configuration. Today I logged in to update and had warnings. Over 2k errors with open_basedir. First it was tmp not in open_basedir, fixed it by using /tmp instead of __DIR__ . /../tmp.

Any ideas?

Is this the first time you’ve seen this error? (Y/N): Y

The output of your Nextcloud log in Admin > Logging:

[PHP] Fehler: is_file(): open_basedir restriction in effect. File(/var/www/vhosts/hosting184636.ae8af.netcup.net/cloud.rcrtduisburg.de/httpdocsapps//core/l10n/de.js) is not within the allowed path(s): (/var/www/vhosts/hosting184636.ae8af.netcup.net/cloud.rcrtduisburg.de/httpdocs/:/tmp/:/var/lib/php/sessions:/var/www/vhosts/hosting184636.ae8af.netcup.net/tmp) at /var/www/vhosts/hosting184636.ae8af.netcup.net/cloud.rcrtduisburg.de/httpdocs/lib/private/Template/ResourceLocator.php#100
	GET /settings/admin/logging
	von 2003:e5:df04:e900:1d49:83c3:df84:b9ef von jan um 31.03.2024, 06:32:23

The output of your config.php file in /path/to/nextcloud (make sure you remove any identifiable information!):

Server configuration detail

Operating system: Linux 5.10.0-19-amd64 #1 SMP Debian 5.10.149-2 (2022-10-21) x86_64

Webserver: Unknown (cli)

Database: mysql 8.0.35

PHP version: 8.2.16

Modules loaded: Core, date, libxml, openssl, pcre, zlib, bcmath, bz2, calendar, ctype, dba, dom, hash, fileinfo, filter, ftp, gettext, gmp, json, iconv, SPL, session, mbstring, pcntl, standard, exif, Phar, posix, random, Reflection, imap, shmop, SimpleXML, soap, sockets, sysvmsg, sysvsem, sysvshm, tokenizer, xml, xmlreader, xmlwriter, zip, mysqlnd, imagick, curl, gd, mysqli, PDO, pdo_mysql, xsl, sqlite3, intl, sodium, ldap, tidy, pdo_pgsql, pdo_sqlite, igbinary, redis, ionCube Loader, Zend OPcache

Nextcloud version: 28.0.4 - 28.0.4.1

Updated from an older Nextcloud/ownCloud or fresh install:

Where did you install Nextcloud from: unknown

Signing status

List of activated apps
Enabled:
 - activity: 2.20.0
 - admin_audit: 1.18.0
 - bruteforcesettings: 2.8.0
 - circles: 28.0.0
 - cloud_federation_api: 1.11.0
 - comments: 1.18.0
 - contactsinteraction: 1.9.0
 - dav: 1.29.1
 - federatedfilesharing: 1.18.0
 - federation: 1.18.0
 - files: 2.0.0
 - files_pdfviewer: 2.9.0
 - files_reminders: 1.1.0
 - files_sharing: 1.20.0
 - files_trashbin: 1.18.0
 - files_versions: 1.21.0
 - firstrunwizard: 2.17.0
 - groupfolders: 16.0.5
 - logreader: 2.13.0
 - lookup_server_connector: 1.16.0
 - nextcloud_announcements: 1.17.0
 - notifications: 2.16.0
 - oauth2: 1.16.3
 - password_policy: 1.18.0
 - photos: 2.4.0
 - privacy: 1.12.0
 - provisioning_api: 1.18.0
 - recommendations: 2.0.0
 - related_resources: 1.3.0
 - serverinfo: 1.18.0
 - settings: 1.10.1
 - sharebymail: 1.18.0
 - support: 1.11.1
 - survey_client: 1.16.0
 - systemtags: 1.18.0
 - text: 3.9.1
 - theming: 2.3.0
 - twofactor_backupcodes: 1.17.0
 - updatenotification: 1.18.0
 - user_status: 1.8.1
 - viewer: 2.2.0
 - weather_status: 1.8.0
 - workflowengine: 2.10.0
Disabled:
 - calendar: 4.6.7
 - contacts: 5.5.3
 - dashboard: 7.0.0
 - encryption: 2.8.1
 - files_external
 - files_rightclick: 1.6.0
 - spreed: 18.0.5
 - suspicious_login
 - twofactor_totp
 - user_ldap

Configuration (config/config.php)
{
    "instanceid": "***REMOVED SENSITIVE VALUE***",
    "passwordsalt": "***REMOVED SENSITIVE VALUE***",
    "secret": "***REMOVED SENSITIVE VALUE***",
    "trusted_domains": [
        "rcrt-duisburg.de",
        "rcrtduisburg.de",
        "cloud.rcrtduisburg.de"
    ],
    "datadirectory": "***REMOVED SENSITIVE VALUE***",
    "default_phone_region": "DE",
    "dbtype": "mysql",
    "version": "28.0.4.1",
    "overwrite.cli.url": "https:\/\/cloud.rcrtduisburg.de",
    "dbname": "***REMOVED SENSITIVE VALUE***",
    "dbhost": "***REMOVED SENSITIVE VALUE***",
    "dbport": "",
    "dbtableprefix": "oc_",
    "mysql.utf8mb4": true,
    "dbuser": "***REMOVED SENSITIVE VALUE***",
    "dbpassword": "***REMOVED SENSITIVE VALUE***",
    "installed": true,
    "mail_from_address": "***REMOVED SENSITIVE VALUE***",
    "mail_smtpmode": "smtp",
    "mail_sendmailmode": "smtp",
    "mail_domain": "***REMOVED SENSITIVE VALUE***",
    "mail_smtpsecure": "ssl",
    "mail_smtpauthtype": "LOGIN",
    "mail_smtpauth": 1,
    "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
    "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
    "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
    "mail_smtpport": "465",
    "maintenance": false,
    "theme": "",
    "loglevel": 2,
    "encryption.key_storage_migrated": false,
    "tempdirectory": "\/tmp",
    "app_install_overwrite": [
        "occweb"
    ],
    "filesystem_check_changes": 1,
    "filelocking.enabled": false,
    "activity_use_cached_mountpoints": true,
    "htaccess.RewriteBase": "\/",
    "updater.secret": "***REMOVED SENSITIVE VALUE***"
}

Cron Configuration: Array
(
[backgroundjobs_mode] => cron
[lastcron] => 1711858503
)

External storages: files_external is disabled

Encryption: no

User-backends:

  • OC\User\Database

Browser: unknown

Additional Information

Found a similar issue on my second installation. Same Version, same hoster. Different hosting package.

[PHP] Fehler: is_file(): open_basedir restriction in effect. File(/var/www/vhosts/hosting152312.a2e4f.netcup.net/nextcloudapps//core/l10n/de.js) is not within the allowed path(s): (/var/www/vhosts/hosting152312.a2e4f.netcup.net/nextcloud/:/tmp/:/var/lib/php/sessions:/var/www/vhosts/hosting152312.a2e4f.netcup.net/tmp) at /var/www/vhosts/hosting152312.a2e4f.netcup.net/nextcloud/lib/private/Template/ResourceLocator.php#100
	GET /settings/admin/logging
	von 2003:e5:df04:e900:1d49:83c3:df84:b9ef von jan um 31.03.2024, 06:42:29

There was a topic with a link to the fix (which will be in 28.0.5):

1 Like

Ah nice, thanks @tflidd . Missed the topic.
It worked! Thanks :slight_smile:

This topic was automatically closed 8 days after the last reply. New replies are no longer allowed.