Why is realpath() only working with certain folders?

Question

I am using PHP's realpath() function, and want to know why I get the following output:

bool(false)
string(48) "/var/www/vhosts/website.co.uk/httpdocs"
bool(false)
string(48) "/var/www/vhosts/website.co.uk/httpdocs"

when running this script:

<?php
error_reporting(-1);
header('content-type: text/plain');

var_dump(realpath('/var/www/vhosts/website.co.uk/application'));
var_dump(realpath('/var/www/vhosts/website.co.uk/httpdocs'));
var_dump(realpath(dirname(__FILE__) . '/../application'));
var_dump(realpath(dirname(__FILE__) . '/../httpdocs'));

exit;

with these file permissions:

drwxr-x---  5 username  psaserv 4096 Jul 16 08:22 application
drwxr-x--- 10 username  psaserv 4096 Jul 16 13:34 httpdocs

Note:

• This is a Plesk system
• Script runs as apache user
• apache user is part of the psaserv group

Answer 1

Plesk and openbase_dir restrictions

Unless plesk has changed in the past few years - it sets open_basedir restrictions such that you can only access the httpdocs folder:

The default open_basedir settings gives you the ability to write to 2 locations for each website. There should be no reason to write to any other folder. [...]

• /tmp
• /var/www/vhosts/domain.com/httpdocs

As such if a request attempts to read from/write to any other location - it won't be able to do so, hence realpath will return false for any location outside the httpdocs folder.

---

if you would like to see the script linked in the referenced forum post, it moved and can be found here: unplesk.