detect when open_basedir causes php_binary_path to be ignored in system report

[nxmndr]

Hello.

Despite setting the value php_binary_path = "/usr/bin/php8.2" (to our standard, ELF executable, not a symlink, PHP binary), and clearing the cache as per the doc, the value of "PHP Found Binary" in diagnostics remains : /usr/bin/php -q (which FTR is 7.2 and for now cannot be updated for compatibility with other websites).

I ran wp shell to see what the findPhpBinarymethod would give and it works :

include_once WP_PLUGIN_DIR . '/matomo/app/matomo.php'
$c = new \Piwik\CliMulti\CliPhp;
$c->findPhpBinary(); // "/usr/bin/php8.2"

Out of ideas, I also defined php_binary_path in other "ini" files (config/common.config.ini.php and app/config/global.ini.php), in the [General] section and cleared cache, without result.

/usr/bin/php8.2 -r "echo php_sapi_name();" # cli

We have full access on this server, so there is no hosting provider limitations. I can check any file.

Versions :

• PHP : 8.2.26
• WP : 6.7.2
• Matomo : 5.2.0

Thanks in advance.

[diosmosis]

Hello @nxmndr, that is strange...

Can you check if the following code returns true: file_exists('/usr/bin/php8.2'); or file_exists($c->findPhpBinary());?

Would you also be able to check the contents of $general in https://github.com/matomo-org/matomo-for-wordpress/blob/develop/app/core/CliMulti/CliPhp.php#L17? By, for example, outputting the contents to debug.log via error_log(var_export($general, true)).

[d-damien]

Forgot to add : we had that issue on two websites.

> file_exists ("/usr/bin/php8.2")
true

> error_log(var_export(Config::getInstance()->General))
array (
  'enable_processing_unique_visitors_day' => 1,
  'enable_processing_unique_visitors_week' => 1,
  'enable_processing_unique_visitors_month' => 1,
  'enable_processing_unique_visitors_year' => 0,
  'enable_processing_unique_visitors_range' => 0,
  'enable_processing_unique_visitors_multiple_sites' => 0,
  'enabled_periods_UI' => 'day,week,month,year,range',
  'enabled_periods_API' => 'day,week,month,year,range',
  'enable_segments_cache' => 1,
  'maintenance_mode' => 0,
  'release_channel' => 'latest_stable',
  'action_url_category_delimiter' => '/',
  'action_title_category_delimiter' => '',
  'action_category_level_limit' => 10,
  'autocomplete_min_sites' => 5,
  'site_selector_max_sites' => 15,
  'show_multisites_sparklines' => 1,
  'all_websites_website_per_page' => 50,
  'anonymous_user_enable_use_segments_API' => 1,
  'browser_archiving_disabled_enforce' => 0,
  'currencies' => 
  array (
    'BTC' => 'Bitcoin',
  ),
  'default_invite_user_token_expiry_days' => 7,
  'enable_create_realtime_segments' => 1,
  'enable_segment_suggested_values' => 1,
  'adding_segment_requires_access' => 'view',
  'allow_adding_segments_for_all_websites' => 1,
  'process_new_segments_from' => 'beginning_of_time',
  'action_default_name' => 'index',
  'default_language' => 'en',
  'datatable_default_limit' => 10,
  'datatable_row_limits' => '5,10,25,50,100,250,500,-1',
  'API_datatable_default_limit' => 100,
  'datatable_export_range_as_day' => 'rss',
  'default_day' => 'yesterday',
  'default_period' => 'day',
  'time_before_today_archive_considered_outdated' => 1800,
  'time_before_week_archive_considered_outdated' => 3500,
  'time_before_month_archive_considered_outdated' => 7100,
  'time_before_year_archive_considered_outdated' => 14300,
  'time_before_range_archive_considered_outdated' => 3600,
  'archive_failure_recovery_timeout' => 86400,
  'enable_browser_archiving_triggering' => 0,
  'archiving_range_force_on_browser_request' => 1,
  'archiving_custom_ranges' => 
  array (
    0 => '',
  ),
  'archiving_query_max_execution_time' => 7200,
  'disable_archiving_segment_for_plugins' => '',
  'disable_archive_actions_goals' => 0,
  'enable_sql_optimize_queries' => 0,
  'purge_date_range_archives_after_X_days' => 1,
  'minimum_mysql_version' => 4.1,
  'minimum_memory_limit' => 128,
  'minimum_memory_limit_when_archiving' => 768,
  'disable_checks_usernames_attributes' => 0,
  'hash_algorithm' => 'whirlpool',
  'password_hash_algorithm' => 'default',
  'password_hash_argon2_threads' => 'default',
  'password_hash_argon2_memory_cost' => 'default',
  'password_hash_argon2_time_cost' => 'default',
  'force_ssl' => 1,
  'csp_enabled' => 1,
  'csp_report_only' => 0,
  'host_validation_use_server_name' => 0,
  'geolocation_download_from_trusted_hosts' => 
  array (
    0 => 'maxmind.com',
    1 => 'db-ip.com',
    2 => 'ip2location.com',
  ),
  'session_gc_probability' => 1,
  'login_cookie_name' => 'matomo_auth',
  'login_cookie_expire' => 1209600,
  'login_cookie_path' => '',
  'login_session_not_remembered_idle_timeout' => 3600,
  'login_password_recovery_replyto_email_address' => 'no-reply@{DOMAIN}',
  'login_password_recovery_replyto_email_name' => 'No-reply',
  'login_allowlist_apply_to_reporting_api_requests' => 1,
  'login_allow_logme' => 0,
  'enable_framed_pages' => 0,
  'enable_framed_settings' => 0,
  'enable_framed_allow_write_admin_token_auth' => 0,
  'only_allow_secure_auth_tokens' => 0,
  'language_cookie_name' => 'matomo_lang',
  'noreply_email_address' => 'noreply@{DOMAIN}',
  'noreply_email_name' => '',
  'contact_email_address' => '',
  'emails_enabled' => 1,
  'enable_update_users_email' => 1,
  'feedback_email_address' => 'feedback@matomo.org',
  'scheduled_reports_replyto_is_user_email_and_alias' => 0,
  'scheduled_reports_truncate' => 23,
  'datatable_archiving_maximum_rows_referrers' => 1000,
  'datatable_archiving_maximum_rows_subtable_referrers' => 50,
  'datatable_archiving_maximum_rows_userid_users' => 50000,
  'datatable_archiving_maximum_rows_custom_dimensions' => 1000,
  'datatable_archiving_maximum_rows_subtable_custom_dimensions' => 1000,
  'datatable_archiving_maximum_rows_actions' => 500,
  'datatable_archiving_maximum_rows_subtable_actions' => 100,
  'datatable_archiving_maximum_rows_site_search' => 500,
  'datatable_archiving_maximum_rows_events' => 500,
  'datatable_archiving_maximum_rows_subtable_events' => 500,
  'datatable_archiving_maximum_rows_products' => 10000,
  'datatable_archiving_maximum_rows_standard' => 500,
  'archiving_ranking_query_row_limit' => 50000,
  'visitor_log_maximum_actions_per_visit' => 500,
  'live_widget_refresh_after_seconds' => 30,
  'live_widget_visitor_count_last_minutes' => 3,
  'live_visitor_profile_max_visits_to_aggregate' => 100,
  'live_query_max_execution_time' => -1,
  'multisites_refresh_after_seconds' => 300,
  'show_update_notification_to_superusers_only' => 0,
  'assume_secure_protocol' => 1,
  'multi_server_environment' => 0,
  'proxy_uri_header' => 0,
  'proxy_ip_read_last_in_list' => 1,
  'enable_trusted_host_check' => 1,
  'api_service_url' => 'https://api.matomo.org',
  'graphs_default_period_to_plot_when_period_range' => 'day',
  'graphs_show_evolution_within_selected_period' => 0,
  'graphs_default_evolution_graph_last_days_amount' => 30,
  'overlay_following_pages_limit' => 300,
  'overlay_disable_framed_mode' => 0,
  'enable_custom_logo' => 0,
  'enable_custom_logo_check' => 1,
  'absolute_chroot_path' => '',
  'tmp_path' => '/tmp',
  'php_binary_path' => '/usr/bin/php8.2',
  'enable_load_data_infile' => 0,
  'enable_plugins_admin' => 0,
  'plugin_trial_request_expiration_in_days' => 28,
  'enable_users_admin' => 0,
  'enable_sites_admin' => 0,
  'enable_plugin_upload' => 0,
  'enable_installer' => 0,
  'enable_geolocation_admin' => 0,
  'enable_delete_old_data_settings_admin' => 1,
  'enable_general_settings_admin' => 0,
  'enable_internet_features' => 1,
  'enable_auto_update' => 0,
  'enable_update_communication' => 0,
  'allowed_outgoing_protocols' => 'http,https',
  'force_matomo_http_request' => 0,
  'always_load_commands_from_plugin' => '',
  'pivot_by_filter_enable_fetch_by_segment' => 0,
  'pivot_by_filter_default_column_limit' => 10,
  'piwik_professional_support_ads_enabled' => 1,
  'num_days_before_tracking_code_reminder' => 5,
  'data_comparison_segment_limit' => 5,
  'data_comparison_period_limit' => 5,
  'custom_cacert_pem' => '',
  'enable_tracking_failures_notification' => 0,
  'rearchive_reports_in_past_last_n_months' => 6,
  'rearchive_reports_in_past_exclude_segments' => 0,
  'enable_required_directories_diagnostic' => 1,
  'enable_referrer_definition_syncs' => 0,
  'disable_tracking_matomo_app_links' => 0,
  'enable_marketplace' => 0,
  'trusted_hosts' => 
  array (
    0 => 'www.blah.tld',
    1 => 'https://www.blah.tld',
  ),
  'salt' => '...',
)

[diosmosis]

If the INI config is correct and the PHP can tell the file exists, perhaps it's a caching issue that could be resolved by restarting your webserver (or php-fpm if you're using it)?

[d-damien]

Tried it without success. But I noticed my changes to ini files were gone after a Matomo update, including the one in wp-upload. Restarted all again without result.

[diosmosis]

@d-damien Can you replace the /path/to/wordpress/wp-content/plugins/matomo/classes/WpMatomo/Admin/SystemReport.php file with https://raw.githubusercontent.com/matomo-org/matomo-for-wordpress/d28085b15d2962b6ea3d00e4e7a5bf6df006bf7d/classes/WpMatomo/Admin/SystemReport.php? Then go to the System Report. There should be a couple new rows under "PHP Found Binary". Can you either sanitize the content and post it here or email the content/screenshot to dizzy (at) innocraft (dot) com?

[diosmosis]

Hi @d-damien, were you able to look at the above comment and try it?

[d-damien]

Email sent.

[diosmosis]

@d-damien It looks like, at the point of the system report, file_exists('/usr/bin/php8.2'); is returning false. Would you know why that is? If you were to create a PHP file that just has <?php var_export(file_exists('/usr/bin/php8.2'));, then access it through a browser, does it display false as well?

You might also check is_readable('/usr/bin/php8.2'), but again, when executing via the browser, rather than via PHP-CLI.

[nxmndr]

Ah nice catch, they DO return false. Could this be linked to open_basedir ?

[diosmosis]

@nxmndr that would seem possible. Are you able to check if that's the cause?

[d-damien]

This works with open_basedir indeed ! If I understand this well, adding /usr/bin to it is not an issue on modern systems that use separate users and php-fpm instead of www-data and mod_php.

[d-damien]

I'm just surprised you didn't meet the issue sooner.

I will still ask our sysadmin about security.

[d-damien]

So I asked and they accepted, but per principle only on the relevant vhosts. I consider the issue solved.