Bug #68535 [Opn]: Uploaded files are not deleted because of missing impersonation

Edit report at https://bugs.php.net/bug.php?id=68535&edit=1 ID: 68535 Updated by: requinix@php.net Reported by: lf at evasys dot de Summary: Uploaded files are not deleted because of missing impersonation Status: Open Type: Bug Package: IIS related Operating System: Windows Server 2012 PHP Version: 5.5.19 Block user comment: N Private report: N New Comment: Sounds like a configuration issue with your temp directory, not with PHP itself. What's the state of the permissions? Temp folders typically get CREATOR OWNER with (nearly) full rights, or else the IUSR needs them. And remember that there are separate permissions for creating, modifying, and deleting files. Previous Comments: ------------------------------------------------------------------------ [2014-12-01 23:00:32] lf at evasys dot de Description: ------------ When uploading a file by a HTML form to a PHP script, the uploaded file will remain in upload_tmp_dir, even when the request ended (and this file was not removed explicitly by the PHP code). Test script: --------------- Any file upload from a multipart HTML form. Expected result: ---------------- Unused, not moved or not deleted temp files of a file upload are normally deleted by PHP when the request ended. We can reproduce this on Apache environments. This is also the behavior php.net describes for file uploads: "The file will be deleted from the temporary directory at the end of the request if it has not been moved away or renamed.", see: http://php.net/manual/en/features.file-upload.post-method.php We can also see in procmon that php.cgi.exe tries to delete the temp file. Actual result: -------------- The file is created in upload_tmp_dir. In our case with the IUSR account since we use "Anonymous Authentication" in IIS. The file is not touched by the PHP code. The request ends. PHP tries to delete the temporary file, but the access is denied. We analyzed this with procmon. What you can see there is, that php-cgi.exe process seems not impersonate on the delete request like on move_uploaded_file() or any other filesystem access. Workaround: If we add MODIFY rights for IIS_IUSRS group on uploaded_tmp_dir the file will be deleted after the request ended as expected. Environment: PHP 5.3.x/5.4.x via FCGI on IIS 7.x Reproduced on WS2012, WS2008 R2. This may also be a security releated issue, because when PHP does not delete temp files created by uploads the server is vulnerable by a possible DoS attack. Maybe related to https://bugs.php.net/bug.php?id=54951 ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=68535&edit=1