False WARNING "PHP cli binary is not available in the jail" when PHP is present via global jailkit_c

Discussion in 'Developers' Forum' started by RalphGL, Jun 16, 2026 at 1:00 PM.

Tags:
  1. RalphGL

    RalphGL New Member

    Hi,
    I'd like to report a bug I found in ISPConfig's Jailkit handling. I searched the forum but couldn't find an existing report for this specific scenario.

    Environment:
    • Debian 13
    • ISPConfig 3.3.1p1 (latest stable)
    • Apache + PHP-FPM
    • PHP 8.4 / 8.5
    Problem:
    When a website has PHP disabled (php = no) or no explicit PHP version assigned (server_php_id = 0), but an SSH/SFTP jail user is configured, ISPConfig sends a false warning email:

    WARNING - The PHP cli binary is not available in the jail of the web example.de / SSH/SFTP user: username. Check your Jailkit setup!
    This warning is incorrect when PHP binaries have been added to all jails via the global Jailkit chroot app sections setting under System → Server Config → Jailkit.

    Steps to reproduce:
    1. Add php8_4 to System → Server Config → Jailkit → Jailkit chroot app sections
    2. Create a website with PHP disabled (php = no) – leave server_php_id = 0
    3. Create an SSH/SFTP jail user for that website
    4. Receive the WARNING email despite PHP being fully functional in the jail
    Proof that PHP works fine in the jail:

    Code:
    chroot /var/www/clients/clientX/webY /usr/bin/php --version
    PHP 8.4.22 (cli) (built: Jun  6 2026 06:50:35) (NTS)
    Copyright (c) The PHP Group
    Built by Debian
    Zend Engine v4.4.22, Copyright (c) Zend Technologies
    Root cause:
    In shelluser_jailkit_plugin.inc.php, function _setup_shell_php(), around line 825:

    PHP:
    if(!file_exists($php_binary_path)) {
        
    $app->log("The PHP cli binary " $this->web['php_cli_binary'] .
                  
    " is not available in the jail..."LOGLEVEL_WARN);
    The check relies solely on php_cli_binary from the server_php join, which is empty when server_php_id = 0. It does not check whether a PHP binary is actually present in the jail via the global app sections.

    Suggested fix:
    Before logging the warning, additionally verify whether any PHP binary exists in the jail:

    PHP:
    $jail_has_php = !empty(glob($web_docroot '/usr/bin/php*'));
    if(!
    file_exists($php_binary_path) && !$jail_has_php) {
        
    $app->log("The PHP cli binary..."LOGLEVEL_WARN);
    This way the warning is only triggered when PHP is genuinely missing from the jail, not when it was installed via the global Jailkit sections.

    Thanks for looking into this!
     
    till likes this.
  2. till

    till Super Moderator Staff Member ISPConfig Developer

    Thank you for the issue report!
     
  3. till

    till Super Moderator Staff Member ISPConfig Developer

Share This Page