Using osTicket v1.18.1 instance on Debian GNU/Linux 12 (Stable) with Apache2 and PHP 8.2.26
I've achieved to enable plugins only by setting this directive temporarily in virtualhost:
php_admin_value open_basedir none
After enabling them, I could restore secure open_basedir
and osTicket works well with plugins.
php_admin_value open_basedir /srv/www/mysite.net/
THEN I think something is wrong in osTicket around this; Normal server with normal securities (such as open_basedir restricted to website's directory) should be fine for this CMS. I run other software perfectly there without this problem (Wordpress, private MediaWiki, Moodle, etc.) and all of them with private and public file referencing.
.phar
files seem to be closed-source software because they are in a compiled form.
What do they need from my entire filesystem??
Bad policy to system administrators trust to this software.