Open_basedir warning for multiselect.css

[ghost]

Only have the (from my PoV) relevant stuff filled out.

Steps to reproduce

1. Having calendar 1.1 installed
2. Open calendar app (main view)
3. See open_basedir messages in owncloud.og
   -> Also seen here: Make event to "all day" by drag and drop #323

Expected behaviour

No open_basedir message should be shown in logfile

Actual behaviour

open_basedir message are shown in logfile

Server configuration

Web server: nginx 1.8.x
Database: MariaDB 10.1.x
PHP version: 7.0.5
ownCloud version: 9.0.1
Calendar version: 1.1

ownCloud log (data/owncloud.log)

{"reqId":"0WVY4O\/pGlb0vZBmUeBn","remoteAddr":"xxx","app":"PHP","message":"is_file(): open_basedir restriction in effect. File(\/var\/www\/owncloud\/calendar\/css\/..\/..\/..\/core\/css\/multiselect.css) is not within the allowed path(s): (\/tmp:\/var\/www\/owncloud:\/usr\/bin:\/dev\/urandom) at \/var\/www\/owncloud\/lib\/private\/template\/resourcelocator.php#101","level":3,"time":"2016-04-14T16:57:37+02:00","method":"GET","url":"\/apps\/calendar\/","user":"xxx"}

[ghost]

Just also have inspected the calendar main page and noticed that the multiselect.css from core is included twice.

<link rel="stylesheet" href="/core/css/multiselect.css?v=fe05c41ba207e6ee1adbbceec2ebd2ba" media="screen">

and

<link rel="stylesheet" href="/apps/calendar/css/../../../core/css/multiselect.css?v=fe05c41ba207e6ee1adbbceec2ebd2ba" media="screen">

[ghost]

Matching report in core: owncloud/core#23587

[georgehrke]

it's included here: https://github.com/owncloud/calendar/blob/master/templates/main.php#L27

[ghost]

Yes, but the path should be still fine or am i wrong?

Somehow the calendar app thinks it is located in:

/var/www/owncloud/calendar

instead of:

/var/www/owncloud/apps/calendar

which is causing this wrong include. The man question is what is causing that? The app or core?