recently installed some debugging software on our server and realised that most errors are coming from realpath() in Wordpress sites.

realpath() [<a href='function. realpath'>function. realpath</a>]: open_basedir restriction in effect. File(/var/www/vhosts/ xxx. com) is not within the allowed path(s): (/var/www/vhosts/ xxx. com/httpdocs/:/tmp/)

The sites are working OK but these are bugging me. Mostly because its hard to see any serious errors coming up!

Would errors like this also affect performance?

  • This is a PHP question not a WordPress one, you're passing paths into realpath that are outside the apache allowable area, stackoverflow.com/questions/1846882/… – Tom J Nowell Feb 20 '13 at 11:04
  • maybe - but a lot of Wordpress users have found a solution to this by changing Wordpress settings. And its curious that it would be built with this error but still work? – v3nt Feb 20 '13 at 11:22
  • You dont mention what URL was called or where the call to realpath was made. The problem lies in accessing folders you have no business accessing ( as far as your php.ini is concerned ). If you have examples of people changing WordPress settings please provide links so that others can see, else all I see is a standard PHP core function being called on something it has been told it is not allowed to touch. – Tom J Nowell Feb 20 '13 at 11:26
  • its getting flagged on most pages and leads back to wp-config.php. ie in realpath called at /var/www/vhosts/xxx.com/httpdocs/wp-config.php (4) &hellip; WP_LOCATION called at /var/www/vhosts/xxx.com/httpdocs/wp-config.php (22) in require_once called at /var/www/vhosts/xxx.com/httpdocs/wp-load.php (29) &hellip;re_once called at /var/www/vhosts/xxx.com/httpdocs/wp-admin/admin.php (30) &hellip;re_once called at /var/www/vhosts/xxx.com/httpdocs/wp-admin/tools.php (10) – v3nt Feb 20 '13 at 11:29
  • can you edit your question to include the line of code and the surrounding code, also are you making use of symbolic links? – Tom J Nowell Feb 20 '13 at 11:34

Looks like you are using one of the hacks to have the same wp-config.php file in development and deployment environments. AS it is noted at the end of that page, the hack were not tested in restricted environments like your. If you are not in development phase anymore then you should change your code in wp-config.php and manually set the constants instead of relying on location detection.

  • yes - realised last night ! We moved all a bunch of stuff to a testing server and never removed it once it was live. Still have some errors flagging up but only a small % compared to before. Dc – v3nt Feb 21 '13 at 13:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.