Bug #55804 [Opn]: tempnam(): wrong fallback to /tmp

Edit report at https://bugs.php.net/bug.php?id=55804&edit=1 ID: 55804 User updated by: spam2 at rhsoft dot net Reported by: spam2 at rhsoft dot net Summary: tempnam(): wrong fallback to /tmp Status: Open Type: Bug Package: Safe Mode/open_basedir Operating System: Linux PHP Version: 5.3.8 Block user comment: N Private report: N New Comment: they are not removed or how should a stat-call in a terminal show that they are existing? anyways - they must not be created Warning: fopen() [function.fopen.php]: open_basedir restriction in effect. File(/tmp/rhcsv5f9RIs) is not within the allowed path(s): (/mnt/data/www/beta.rhsoft.net:/Volumes/dune/www-servers/phpincludes:/var/www/uploadtemp) in /mnt/data/www/beta.rhsoft.net/tempname.php on line 6 Warning: fopen(/tmp/rhcsv5f9RIs) [function.fopen.php]: failed to open stream: Operation not permitted in /mnt/data/www/beta.rhsoft.net/tempname.php on line 6 [harry@srv-rhsoft:~]$ stat /tmp/rhcsv5f9RIs Datei: „/tmp/rhcsv5f9RIs“ Größe: 0 Blöcke: 0 EA Block: 4096 reguläre leere Datei Gerät: 809h/2057d Inode: 48 Verknüpfungen: 1 Zugriff: (0600/-rw-------) Uid: ( 48/ apache) Gid: ( 48/ apache) Zugriff : 2011-09-28 08:58:01.046916064 +0200 Modifiziert: 2011-09-28 08:58:01.046916064 +0200 Geändert : 2011-09-28 08:58:01.046916064 +0200 Previous Comments: ------------------------------------------------------------------------ [2011-09-28 09:14:51] pajoye@php.net if the files are not removed on request or sapi shutdown, then we have a bug. ------------------------------------------------------------------------ [2011-09-28 09:13:01] spam2 at rhsoft dot net > Documented behavior, changing it will break BC what sort of BC? the created file is outside open_basedir, can not be used and can not be deleted so this file is useless and simply at the wrong location i can not imagine any code which useful relies on that "feature" ------------------------------------------------------------------------ [2011-09-28 09:09:51] pajoye@php.net Documented behavior, changing it will break BC. To correctly configure the temp directory in each host is a the way to go for now. ------------------------------------------------------------------------ [2011-09-28 09:05:35] spam2 at rhsoft dot net Description: ------------ tempnam() should NOT fall back to /tmp if the $dir-param is explicit set to a real-path inside the open_basedir and because of wrong permissions $dir is not writeable Test script: --------------- <?php $temp_folder = dirname(__FILE__) . '/temp/'; mkdir($temp_folder); chmod($temp_folder, 0555); $tmp_name = str_replace("\\", '/', tempnam($temp_folder, 'rhcsv')); $fp = fopen($tmp_name, 'wb+'); if($fp) { flock($fp, LOCK_EX); fwrite($fp, 'test'); flock($fp, LOCK_UN); fclose($fp); } ?> Expected result: ---------------- error message that $dir is not writeable Actual result: -------------- temporary file is created in /tmp which violates open_basedir and fopen() is failing with open_basedir restriction messages ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=55804&edit=1