Bug #68535 [Com]: Uploaded files are not deleted because of missing impersonation

Edit report at https://bugs.php.net/bug.php?id=68535&edit=1 ID: 68535 Comment by: lf at evasys dot de Reported by: lf at evasys dot de Summary: Uploaded files are not deleted because of missing impersonation Status: Feedback Type: Bug Package: IIS related Operating System: Windows Server 2012 PHP Version: 5.5.19 Block user comment: N Private report: N New Comment: IUSR has MODIFY rights to this folder. This folder is also used for session files which can be/are deleted by GC. The upload tmp files (like any other file created in our PHP/IIS environments) were originated by IUSR, so it makes so sense to me, why IUSR shouldn't be able to remove especially this upload tmp files but any other file originated by IUSR. When I create and then delete a file in the same directory by a simple test script it is also working. There is something absolutely going wrong, when PHP tries to delete the temp files of uploads on IIS webserver. At least I can see in procmon that the impersonation is missing on this delete action. Previous Comments: ------------------------------------------------------------------------ [2014-12-01 23:14:54] requinix@php.net Sounds like a configuration issue with your temp directory, not with PHP itself. What's the state of the permissions? Temp folders typically get CREATOR OWNER with (nearly) full rights, or else the IUSR needs them. And remember that there are separate permissions for creating, modifying, and deleting files. ------------------------------------------------------------------------ [2014-12-01 23:00:32] lf at evasys dot de Description: ------------ When uploading a file by a HTML form to a PHP script, the uploaded file will remain in upload_tmp_dir, even when the request ended (and this file was not removed explicitly by the PHP code). Test script: --------------- Any file upload from a multipart HTML form. Expected result: ---------------- Unused, not moved or not deleted temp files of a file upload are normally deleted by PHP when the request ended. We can reproduce this on Apache environments. This is also the behavior php.net describes for file uploads: "The file will be deleted from the temporary directory at the end of the request if it has not been moved away or renamed.", see: http://php.net/manual/en/features.file-upload.post-method.php We can also see in procmon that php.cgi.exe tries to delete the temp file. Actual result: -------------- The file is created in upload_tmp_dir. In our case with the IUSR account since we use "Anonymous Authentication" in IIS. The file is not touched by the PHP code. The request ends. PHP tries to delete the temporary file, but the access is denied. We analyzed this with procmon. What you can see there is, that php-cgi.exe process seems not impersonate on the delete request like on move_uploaded_file() or any other filesystem access. Workaround: If we add MODIFY rights for IIS_IUSRS group on uploaded_tmp_dir the file will be deleted after the request ended as expected. Environment: PHP 5.3.x/5.4.x via FCGI on IIS 7.x Reproduced on WS2012, WS2008 R2. This may also be a security releated issue, because when PHP does not delete temp files created by uploads the server is vulnerable by a possible DoS attack. Maybe related to https://bugs.php.net/bug.php?id=54951 ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=68535&edit=1