#38934 [Opn->Csd]: move_uploaded_file() cannot read uploaded file outside of open_basedir

ID: 38934 Updated by: iliaa@php.net Reported By: phpbugs at thequod dot de -Status: Open +Status: Closed -Bug Type: Documentation problem +Bug Type: Safe Mode/open_basedir Operating System: Ubuntu Linux PHP Version: 5.1.6 New Comment: This bug has been fixed in the documentation's XML sources. Since the online and downloadable versions of the documentation need some time to get updated, we would like to ask you to be a bit patient. Thank you for the report, and for helping us make our documentation better. Previous Comments: ------------------------------------------------------------------------ [2006-10-03 11:54:20] youza at post dot cz See this bug - http://bugs.php.net/bug.php?id=37236 not any response from PHP :-))) ------------------------------------------------------------------------ [2006-10-02 20:03:38] phpbugs at thequod dot de Since when? As far as I understood, you have expected it to work like this (when trying to reproduce it). Also, from older bug reports, it had been fixed to work like this again. Additionally, from a security perspective, it would open up the upload_tmp_dir for all processes sharing the same php.ini/upload_tmp_dir and you would have to manually set it for every vhost where you use open_basedir for to an own directory. If it's supposed to stay a documentation problem, please emphasize it in the NEWS/upgrade docs, because as it is now (e.g. failing since 5.1.6), it will break all upload scripts for hosts that use open_basedir. IMHO it should work just like expected: PHP should internally allow the temporary uploaded file to get stored in upload_tmp_dir and should allow move_uploaded_file() to move it - PHP should know that it has to make an exception here to the regular open_basedir restriction (and it seemed to have done so before). ------------------------------------------------------------------------ [2006-10-02 09:28:17] tony2001@php.net Reclassified as docu problem. upload_tmp_dir must be in open_basedir() to be readable/writable. ------------------------------------------------------------------------ [2006-09-30 15:25:14] phpbugs at thequod dot de Just tried it with PHP_5_2 (CVS), resulting in: Warning: Unknown: open_basedir restriction in effect. File(/tmp) is not within the allowed path(s): (/var/www) in Unknown on line 0 Warning: File upload error - unable to create a temporary file in Unknown on line 0 I've configured PHP just with "--with-apxs2=/usr/bin/apxs2" and use this simple php.ini file: open_basedir = "/var" display_errors=on display_startup_errors=On error_reporting=E_ALL ------------------------------------------------------------------------ [2006-09-29 18:29:26] moron at industrial dot org Sorry for the flurry. In our case it turned out that the error message was just misleading. A simple permissions issue on the target directory was the cause (arrgh) but the error message explicitly stated that the problem was the open_basedir setting of the upload_tmp directory. So more of an annoyance than a show stopper in our case. ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at http://bugs.php.net/38934 -- Edit this bug report at http://bugs.php.net/?id=38934&edit=1