php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Doc Bug #52460 undocumented upload_tmp_dir fallback vs. open_basedir
Submitted: 2010-07-27 18:49 UTC Modified: 2010-10-23 09:56 UTC
From: ys at tm-company dot de Assigned: kalle (profile)
Status: Closed Package: Documentation problem
PHP Version: 5.3.3 OS: Debian Lenny
Private report: No CVE-ID: None
View Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
If you reported this bug, you can edit this bug over here.
(description)
Block user comment
Status: Assign to:
Package:
Bug Type:
Summary:
From: ys at tm-company dot de
New email:
PHP Version: OS:

 

 [2010-07-27 18:49 UTC] ys at tm-company dot de 
Description:
------------
When upload_tmp_dir is not writable by the user PHP runs as, PHP falls back to the system default (eg. /tmp/). This is not stated in the documentation which reads "If not *specified* PHP will use the system's default."

Sample config:
  upload_tmp_dir /var/www/tmp/
  open_basedir /var/www/

Uploading a file with /var/www/tmp not writable by PHP, PHP gives an erroneous warning message that points to open_basedir problems with /tmp/ rather than the actual upload_tmp_dir.

A very similar problem was reported in http://bugs.php.net/bug.php?id=44562 but rejected.

Originally found in 5.2.6-1+lenny8 and confirmed in 5.3.3.

Test script:
---------------
<html>
  <head><title>Upload Bug test</title></head>
  <body>
    <form method="post" action="<?php echo $_SERVER['PHP_SELF']; ?>" enctype="multipart/form-data">
      <input type="file" name="userfile" /> <input type="submit" value="go" />
    </form>
<?php
  if (isset($_FILES['userfile'])) {
    if (!is_uploaded_file($_FILES['userfile']['tmp_name']) || !is_file($_FILES['userfile']['tmp_name'])) {
      echo "upload_problem with {$_FILES["userfile"]["tmp_name"]}<br />\n";
      echo "upload_tmp_dir is " . ini_get("upload_tmp_dir") . "<br />\n";
    }
    echo "done";
  }
?>
  </body>
</html>

Expected result:
----------------
PHP Warning:  File upload error - unable to create a temporary file in /var/www/tmp in Unknown on line 0

Actual result:
--------------
PHP Warning:  Unknown: open_basedir restriction in effect. File(/tmp) is not within the allowed path(s): (/var/www/) in Unknown on line 0
PHP Warning:  File upload error - unable to create a temporary file in Unknown on line 0

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2010-10-22 14:39 UTC] kalle@php.net
-Package: Filesystem function related +Package: Documentation problem
 [2010-10-23 09:56 UTC] kalle@php.net 
Automatic comment from SVN on behalf of kalle
Revision: http://svn.php.net/viewvc/?view=revision&amp;revision=304644
Log: Fixed bug #52460 (undocumented upload_tmp_dir fallback vs. open_basedir)
 [2010-10-23 09:56 UTC] kalle@php.net
-Status: Open +Status: Closed -Assigned To: +Assigned To: kalle
 [2010-10-23 09:56 UTC] kalle@php.net 
This bug has been fixed in the documentation's XML sources. Since the
online and downloadable versions of the documentation need some time
to get updated, we would like to ask you to be a bit patient.

Thank you for the report, and for helping us make our documentation better.
 [2020-02-07 06:08 UTC] phpdocbot@php.net 
Automatic comment on behalf of kalle
Revision: http://git.php.net/?p=doc/en.git;a=commit;h=4e269b01572b9d9e0af68e13ba73347923055588
Log: Fixed bug #52460 (undocumented upload_tmp_dir fallback vs. open_basedir)
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved. 		Last updated: Sat Jul 12 10:01:33 2025 UTC