Summary

On a clean MantisBT 2.28.4 installation, the admin installation check reports multiple FAIL results when PHP open_basedir restricts access to the default Graphviz path /usr/bin/.

One of the reported failures appears to be misleading:

absolute_path configuration option has a trailing directory separator

The absolute_path value is correct and the corresponding condition evaluates to true.

Environment

• MantisBT: 2.28.4
• PHP: with open_basedir enabled

• Example open_basedir:

  /var/www/example.com

• Default Graphviz path:

  $g_graphviz_path = '/usr/bin/';

• Relationship graphs:

  $g_relationship_graph_enable = OFF;

Steps to reproduce

1. Install a clean MantisBT 2.28.4 release.

2. Configure PHP with an open_basedir restriction, for example:

   open_basedir = /var/www/example.com

3. Leave the default Graphviz configuration unchanged:

   $g_graphviz_path = '/usr/bin/';

4. Open the MantisBT Admin → Check Installation page.

Actual result

The following checks are reported as FAIL:

absolute_path configuration option has a trailing directory separator

graphviz_path configuration option points to a valid directory
The path '/usr/bin/' is not a valid directory.

graphviz_path configuration option points to an accessible directory
The path '/usr/bin/' is not accessible.

The Graphviz failures are understandable because /usr/bin/ is outside the configured open_basedir.

However, the absolute_path check is also marked as FAIL, even though its value is correct.

Example runtime value:

/var/www/example.com/public_html/mantisbt-2.28.4/

The exact condition used by the admin check:

substr( $t_path['config_value'], -1, 1 ) == DIRECTORY_SEPARATOR

evaluates to:

bool(true)

Additional investigation

Calling:

realpath('/usr/bin/');

results in an open_basedir restriction warning and returns:

bool(false)

The admin check function contains:

$t_unhandled = check_unhandled_errors_exist();

if( $p_pass && !$t_unhandled ) {
    $t_result = GOOD;
} elseif( $p_warning && !$t_unhandled || $t_unhandled == E_DEPRECATED ) {
    $t_result = WARN;
} else {
    $t_result = BAD;
}

This appears to allow a successful check ($p_pass === true) to be displayed as FAIL when an unrelated unhandled warning is present.

Expected result

• The absolute_path check should report PASS.
• A Graphviz-related warning or failure should not change the result of unrelated configuration checks.

• Ideally, the Graphviz path should not be validated as a required path when Graphviz functionality is disabled:

  $g_relationship_graph_enable = OFF;

Notes

The issue is reproducible with a clean MantisBT 2.28.4 installation, so it does not appear to be caused by modified or leftover files from an upgrade.

All paths in this report are anonymized examples.