open_basedir possible problem

[thomask]

When installing on default Plesk hosting this error appears on first screen:

Warning: file_exists() [function.file-exists]: open_basedir restriction in effect. File(/var/www/vhosts/seo-konzultant.cz/wp-config.php) is not within the allowed path(s): (/var/www/vhosts/seo-konzultant.cz/httpdocs:/tmp) in /var/www/vhosts/seo-konzultant.cz/httpdocs/wp-load.php on line 32
There doesn't seem to be a wp-config.php file. I need this before we can get started. Need more help? We got it. You can create a wp-config.php file through a web interface, but this doesn't work for all server setups. The safest way is to manually create the file.

This error is not critical - the instalation then works as a charm and it is not strictli 3.0 error, afaik it appears many versions before, i have just never reported it and probably noone else.

Okay, the issue here is that we added support a long while ago for wp-config.php to exist one level up from the WordPress install. In many cases this will be outside of public_html/wwwroot/httpdocs. In this case, that's what your open_basedir is set to.

It's important to point out that the ability to move wp-config.php up one directory is not a security measure designed to get it out of the public directory, but it is designed for advanced SVN/external setups.

The solution would be for us to error suppress the first file_exists check when we look up one directory. (If it fails, we won't get to the second one.) However, this is technically a performance hit for those who run their blogs under that type of setup. Additionally, a typical setup (where wp-config does not reside one directory up) will never reach that code. Thus, the only time this becomes an issue is when WordPress has yet to be installed (no wp-config anywhere) and open_basedir has such a restriction... And while you get an error message, you're also rather immediately greeted with instructions. Confusing, but not going to scare people away entirely. I think I'm thus suggesting a wontfix here.

I do agree with the wontfix. In addition "production" sites should never be run with display_errors enabled.