Fix handling of open_basedir that contains cwd

[nikic]

While resolving the path, the last step will reduce it down to ""
(an empty string) and realpath() will resolve this to getcwd().
If open_basedir contains the CWD, then that means open_basedir
will be bypassed for paths that don't have any components that
exist (if one of the components exists, then we abort the realpath
loop at that point).

[cmb69]

Good catch! Although it is just about the missing open_basedir warning from what I can tell, we should consider targeting PHP 7.4 or 8.0.

[nikic]

Good catch! Although it is just about the missing open_basedir warning from what I can tell, we should consider targeting PHP 7.4 or 8.0.

I think the effect here is slightly larger than only the warning: It should also be possible to create files/directories outside open_basedir. Of course, that requires that the PHP process itself has permissions to write /, e.g. running as root. Which one probably should only be doing when running in Docker.

[cmb69]

Right! I was assuming not running as root, and reasonable permissions. Otherwise, that would be a rather serious security issue.

FWIW, this issue apparently doesn't affect Windows. Still good to have the ckeck there as well.