[php-src] Issue #7848: Uploaded files are owned by root, only after calling fileowner function correct owner is set
| From: | DevDavido | Date: | Wed, 29 Dec 2021 03:08:11 +0000 |
| Subject: | [php-src] Issue #7848: Uploaded files are owned by root, only after calling fileowner function correct owner is set | ||
| Groups: | php.bugs | ||
| Request: | Send a blank email to php-bugs+get-238621@lists.php.net to get a copy of this message | ||
Issue: https://github.com/php/php-src/issues/7848
Author: DevDavido
### Description
The following code in a relatively minimal docker compose setup of PHP + nginx for reproduction:
index.php:
```php
<!DOCTYPE html>
<html>
<head><title>Upload your files</title></head>
<body>
<form enctype="multipart/form-data" action="index.php"
method="POST">
<p>Upload your file</p>
<input type="file" name="uploaded_file" /><br />
<input type="submit" value="Upload" />
</form>
<?php
error_reporting(E_ALL);
clearstatcache();
file_put_contents("lorem", "ipsum");
var_dump(fileowner("lorem"));
unlink("lorem");
if (!empty($_FILES['uploaded_file'])) {
$path = './' . basename($_FILES['uploaded_file']['name']);
if (move_uploaded_file($_FILES['uploaded_file']['tmp_name'], $path)) {
echo "The file " . basename($_FILES['uploaded_file']['name'])
. " has been uploaded";
} else {
echo "There was an error uploading the file, please try again!";
}
//var_dump(fileowner($path));
}
?>
</body>
</html>
```
docker-compose.yml
```yml
services:
web:
image: nginx:latest
ports:
- "8080:80"
volumes:
- ./src:/var/www/html
- ./default.conf:/etc/nginx/conf.d/default.conf
links:
- php-fpm
php-fpm:
image: php:8-fpm
volumes:
- ./src:/var/www/html
```
default.conf:
```conf
server {
index index.php;
server_name phpfpm.local;
error_log /var/log/nginx/error.log;
access_log /var/log/nginx/access.log;
root /var/www/html;
location ~ \.php$ {
try_files $uri =404;
fastcgi_split_path_info ^(.+\.php)(/.+)$;
fastcgi_pass php-fpm:9000;
fastcgi_index index.php;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param PATH_INFO $fastcgi_path_info;
}
}
```
The uid of the temporary file
lorem gets printed correctly (same as php-fpm worker
process uid).
When uploading a file through the form and checking within the PHP container its uid/gid like
docker exec -it <container-name> ls -ls the file owner/group of the uploaded file
is root/root. Only after removing the comment of the second var_dump with
PHP's fileowner function and uploading a file again, the filesystem returns the
correct file owner/group via docker exec -it <container-name> ls -ls.
Not sure if this is related to PHP or any other involved services. Although only after calling
fileowner the correct uid is returned of the uploaded file.
### PHP Version
8.x
### Operating System
Debian 11