FS#36433 - [dokuwiki] Can't reference inc directory

Attached to Project: Community Packages
Opened by MMH (mmh) - Tuesday, 06 August 2013, 18:29 GMT
Last edited by Sergej Pupykin (sergej) - Friday, 15 November 2013, 15:35 GMT
Task Type Bug Report
Category Packages
Status Closed
Assigned To Sergej Pupykin (sergej)
Architecture All
Severity High
Priority Normal
Reported Version
Due in Version Undecided
Due Date Undecided
Percent Complete 100%
Votes 2
Private No

Details

Description:
The symlinks to /etc/$pkgname, /var/lib/$pkgname, etc. cause bugs when paths are referenced.

Example: Suppose the file <installdir>/lib/plugins/ajax.php requires a file <installdir>/inc/init.php. This works fine with the relative path ../../inc/init.php. Since we symlink <installdir>/lib/plugins to /var/lib/dokuwiki/plugins the relative path would end up in /var/lib/inc/init.php which doesn't exist.

This is closely connected to the way webapps are installed in Arch Linux[1].

[1] https://wiki.archlinux.org/index.php/Web_Application_Package_Guidelines


Additional info:
* dokuwiki 20130510-4
* From /var/log/httpd/error_log:

PHP Warning: require_once(): open_basedir restriction in effect. File(/var/lib/dokuwiki/plugins/acl/../../../inc/init.php) is not within the allowed path(s): (/tmp:/usr/share/webapps:/etc/webapps/dokuwiki:/var/lib/dokuwiki) in /var/lib/dokuwiki/plugins/acl/ajax.php on line 10, referer: http://rivendell.informatik.uni-wuerzburg.de/wiki/doku.php?id=start&do=admin&page=acl


Steps to reproduce:
* Install dokuwiki from [community]
* Log in with an account with administrative permissions
* Try to list groups/users


Possible solution:
Rethink the best practice of installing webapps in Arch Linux.
Have a look at the webapp-config tool of the Gentoo community.
This task depends upon

Closed by  Sergej Pupykin (sergej)
Friday, 15 November 2013, 15:35 GMT
Reason for closing:  Fixed
Additional comments about closing:  plugins and templates was moved back to /usr/share/webapps
Comment by MMH (mmh) - Tuesday, 06 August 2013, 21:20 GMT
Ok, this version of the PKGBUILD seems to work.
I just removed the lines that copied and symlinked lib/{plugins,tpl} and made http own lib/plugins.
This might be problematic since the content of the plugins directory can be changed by the webapp.
But it works as a temporary solution.

I still think that a dedicated webapps tool like the Gentoo webapp-config is necessary to get a clean install for webapps (especially for multiple instances).
   PKGBUILD (1.5 KiB)

Loading...