It only happens on my live server, not on my local setup

Hv similar the same warning (since aug) on Joomla 3 and Joomla 4 (live sites):

Warning: is_file(): open_basedir restriction in effect. File(/metadata.xml) is not within the allowed path(s): (/home/my path/tmp:/usr/share/pear:/usr/bin/php_safemode) in /home/mypath/administrator/components/com_menus/src/Model/ItemModel.php on line 1221

It belongs to this: https://github.com/joomla/joomla-cms/blob/4.0-dev/administrator/components/com_menus/src/Model/ItemModel.php#L1221

The hoster wrote me to use this code there: https://forum.joomla.org/viewtopic.php?t=911053 or:

else
                    {
                        $base = "/home/mypath/";
                        // Now check for a component manifest file
                        $path = Path::clean($base . '/metadata.xml');
                    if (is_file($path))
                    {
                        $formFile = $path;
                    }
                }
            }```

Cannot believe this is the way to go.

Thks for your infos

<hr /><sub>This comment was created with the <a href="https://github.com/joomla/jissues">J!Tracker Application</a> at <a href="https://issues.joomla.org/tracker/joomla-cms/35895">issues.joomla.org/tracker/joomla-cms/35895</a>.</sub>

@ChristineWk found this message also for Version 3.4, so it surely is not related to J4.

It seems to be server configuration problem. @rachelwalraven do you know if there were changes in the configuration of your webspace in the last time?

This should be closed

@chmst There havent been any changes to the configuration. Only difference is that 4.0.3 site don't show the warning an d 4.0.4 sites do (same server same acccount).

Because there are only 2 reports of this error and it is probably a server issue I'll close the issue.

I had the same issue after updating from J 3.9 to 3.10 – and found a solution in changing the PHP configuration open_basedir to "none". See:
https://stackoverflow.com/questions/1846882/open-basedir-restriction-in-effect-file-is-not-within-the-allowed-paths

Same issue here on my servers.

I had the same issue after updating from J 3.9 to 3.10 – and found a solution in changing the PHP configuration open_basedir to "none". See:
https://stackoverflow.com/questions/1846882/open-basedir-restriction-in-effect-file-is-not-within-the-allowed-paths

If you're on a shared hosting this is not a good thing to do. open_basedir restrictions are there for a reason.

@TLWebdesign correct. We should find a fallback solution here. https://github.com/joomla/joomla-cms/blob/3.10-dev/administrator/components/com_menus/models/item.php#L1082

Would you mind to re-open this issue?

@TLWebdesign correct. We should find a fallback solution here. https://github.com/joomla/joomla-cms/blob/3.10-dev/administrator/components/com_menus/models/item.php#L1082

Would you mind to re-open this issue?

This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/35895.

I don't have the rights to re-open this issue.

Can someone open this issue so it can be fixed?

@rachelwalraven @TLWebdesign @UlrichDamm Could you test if the changes from pull request (PR) #36789 fix this issue for you and if so, go to the issue tracker here https://issues.joomla.org/tracker/joomla-cms/36789 and use the "Test this" button to submit your test result?

If you are not on 3.10 anymore but on 4.0.x, please test the equivalent PR #36791 for J4.

Thanks in advance.

For me it fixed the problem thanks!

I just discovered this on the site I'm working on, when attempting to add a new menu item. I rebuilt menus, but error remains.

Joomla 3.10.5
PHP 7.4.27

Error message:
Warning: is_file(): open_basedir restriction in effect. File(/metadata.xml) is not within the allowed path(s): (/var/www/vhosts/mywebsite.org/:/tmp/) in /var/www/vhosts/mywebsite.org/httpdocs/new/administrator/components/com_menus/models/item.php on line 1153

I am now attempting to debug this.

So far I've found that $base is empty in this code...

// Now check for a component manifest file
$path = JPath::clean($base . '/metadata.xml');

//jjj: debug
echo "base: [" . $base . "]";
if (is_file($path)) {
    $formFile = $path;
}

UPDATE:

This is a bug, because a null value for "link" is being passed to a function in item.php.

Here's the breakdown of what's causing it...

The warning is produced in ./administrator/components/com_menus/models/item.php

The function in question is: preprocessForm

Inside preprocessForm:

$link = $this->getState('item.link');

The getState function is in libraries/src/MVC/Model/BaseDatabaseModel.php

Here are the contents of $this->state:

[state:protected] => Joomla\CMS\Object\CMSObject Object 
	( [_errors:protected] => Array ( ) 
	  [task] => 
	  [item.id] => 
	  [item.parent_id] => 
	  [item.menutype] => mainmenu 
	  [item.client_id] => 0 
	  [item.menutypeid] => 1 
	  [item.type] => component 
	  [params] => Joomla\Registry\Registry 
               Object ( 
                   [data:protected] => stdClass 
                       Object ( 
			   [page_title] => 
			   [show_page_heading] => 0 
			   [page_heading] => 
			   [pageclass_sfx] => ) 
	          [initialized:protected] => 1 
	          [separator] => . 
               ) 
	   [item.link] => ) 

Notice the last line, item.link, is null.

getState returns item.link equal to null, so $link is null

this in turn causes $args to be null, which causes $base to be null

I don't think $base should ever be null, because that means the resulting path is not within the Joomla root folder.

$base being null causes $path to be "/metadata.xml", i.e. there is no path, only a file name, which causes the is_file(): open_basedir restriction warning.

The question now is, what code is calling preprocessForm with incorrect parameter(s)?

The code calling preprocessForm is ./libraries/src/MVC/Model/FormModel.php, function loadForm, line 244:

// Allow for additional modification of the form, and events to be triggered.
// We pass the data because plugins may require it.
$this->preprocessForm($form, $data);

The value of $data here is:

stdClass Object ( 
    [parent_id] => 
    [level] => 
    [lft] => 
    [rgt] => 
    [alias] => 
    [id] => 
    [menutype] => mainmenu 
    [title] => 
    [note] => 
    [path] => 
    [link] => 
    [type] => component 
    [published] => 
    [component_id] => 
    [checked_out] => 
    [checked_out_time] => 
    [browserNav] => 
    [access] => 1 
    [img] => 
    [template_style_id] => 
    [params] => Array ( ) 
    [home] => 
    [language] => 
    [client_id] => 0 
    [request] => Array ( ) 
    [menuordering] => 0 )

Notice that $data->link is null.

WORKAROUND

I modified the code at line 1150 in item.php:

                    if ($base) {  // added: make sure $base is not null
                        // Now check for a component manifest file
                        $path = JPath::clean($base . '/metadata.xml');

                        if (is_file($path))
                        {
                            $formFile = $path;
                        }
                    }

@durian808 The same question from my previous comment goes to you:

Could you test if the changes from pull request (PR) #36789 fix this issue for you and report back here? The fix has already been merged and so will be included in the next 3.10 release.

Sorry, I am not proficient in this tracker system.

Yes, the change in the PR is equivalent to my WORKAROUND noted above, and I verified my workaround.

The coding of item.php is worrisome to me. It appears there should be separate logic for the case of $base being null, up front in the function, and clarification of what $base being null actually means. I.e. Why should $base ever be null? If that is not normal, what is causing it? Did code somewhere not assign $base, and if so, why? Why would this function be called with $base being null, and are any problems created by calling this function with $base being null?