Luckily we live in a time where the PHP safe_mode is deprecated.
However some legacy webspaces still have this feature, and also open_basedir is often active.
When using cURL this may be some kind of a bummer, because it prevents you from following redirects. This may be due to the fact, that cURL as a native extension would then be able to follow symlinks in the filesystem and access files which it should not be allowed to do.
The problem
You encounter the following error:
The solution
You will find many great approaches to circumenventing this feature when it comes to HTTP connections.
This is done by parsing the Location header directly from the returned data and issuing a new request.
On php.net you will find many solutions. While some are broken, many also work. However, I could not find a solution that worked for my problem:
I wanted to follow a redirect on a site that needed cookies and needed a correct switch of the request-method from POST to GET.
Typically the circumventions copy the cURL-handle which makes it loose the cookies. Also they do no reset the request type, as normal browsers do it.
The code
This code worked for me. Hopefully it works for you.
Note that this code is an improvement to the code from zsalab orgininally posted on php.net
$mr = $maxredirect === null ? 5 : intval($maxredirect);
if (ini_get(‘open_basedir’) == ” && (ini_get(‘safe_mode’) == ‘Off’ || ini_get(‘safe_mode’) == ”)) {
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, $mr > 0);
curl_setopt($ch, CURLOPT_MAXREDIRS, $mr);
} else {
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, false);
if ($mr > 0) {
$newurl = curl_getinfo($ch, CURLINFO_EFFECTIVE_URL);
curl_setopt($ch, CURLOPT_HEADER, true);
curl_setopt($ch, CURLOPT_FORBID_REUSE, false);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
do {
curl_setopt($ch, CURLOPT_URL, $newurl);
$header = curl_exec($ch);
if (curl_errno($ch)) {
$code = 0;
} else {
$code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
if ($code == 301 || $code == 302) {
preg_match(‘/Location:(.*?)\n/’, $header, $matches);
$newurl = trim(array_pop($matches));
curl_setopt($ch, CURLOPT_POSTFIELDS, null); //also switch modes after Redirect
curl_setopt($ch, CURLOPT_HTTPGET, true);
} else {
$code = 0;
}
}
} while ($code && –$mr);
if (!$mr) {
if ($maxredirect === null) {
trigger_error(‘Too many redirects. When following redirects, libcurl hit the maximum amount.’, E_USER_WARNING);
} else {
$maxredirect = 0;
}
return false;
}
curl_setopt($ch, CURLOPT_URL, $newurl);
}
}
return curl_exec($ch);
}
Note
Your first option should however be to fix the PHP settings, as safe-mode is more of a safety issue then a help. Also open_basedir is not the best option either.
The code I posted here slows down the request by 50%. So use it only if absolutely needed.
You can implemented as standard though, as it has a fallback to use the native FOLLOW_LOCATION feature if possible. (TXH to zsalab)
