file_exists(): open_basedir restriction in effect

[gold22]

Description

The following code:

<?php
echo file_exists('C:\Test\test?') ? 'exists' : 'not exists';

Resulted in this output:

PHP Warning:  file_exists(): open_basedir restriction in effect. File(C:\Test\test?) is not within the allowed path(s): (C:\Test) in C:\Test\test.php on line 2
PHP Stack trace:
PHP   1. {main}() C:\Test\test.php:0
PHP   2. file_exists($filename = 'C:\\Test\\test?') C:\Test\test.php:2
not exists

But I expected this output instead:

not exists

PHP Version

PHP 7.4.x, 8.0.x

Operating System

Windows

[damianwadley]

I expect this is a duplicate of https://bugs.php.net/bug.php?id=52065.

[cmb69]

Indeed, this is related to bug 52065. This case is particularly about the wildcard character ? (* exhibits the same behavior). Since the algorithm to resolve the realpath (tsrm_realpath_r()) uses FindFirstFileExW(), which inherently supports these wildcards, we bail out early if a filename contains these characters. This is correct per se, since such files can't exists, but then we hit the issue mentioned in the other bug report.

So, in my opinion, this case (wildcards in the filename) is a documentation issue.

[gold22]

I do not mean ? as a wildcard character, I mean it as a regular symbol.

[cmb69]

You cannot have such a file on Windows NTFS anyway.

[gold22]

I know it and expect the file_exists() function returns 'false' without any warnings. It is not a synthetic case. For example, Laravel framework checks existence of a file like 'Forgot your password?.php' to localize the message 'Forgot your password?'.

[cmb69]

Like I already said in https://bugs.php.net/bug.php?id=52065#1621507683, there is no clean and backward compatible way to fix this. The problem is that php_stat() is called by different functions, and for some the open_basedir warning is important, while for others it should be suppressed. The clean way to solve this would be to add a warn parameter to php_stat(), and to forward this to php_check_open_basedir_ex(), but that would break the API of php_stat(). Introducing php_stat_ex() would be possible, but a lot of extension would not call that function, and even for php-src that would require modifications which I wouldn't want to do for any of the stable versions. A global flag might be a viable workaround, but doesn't look like a clean solution.