[php-src] Issue #7848: Uploaded files are owned by root, only after calling fileowner function correct owner is set

From: Date: Wed, 29 Dec 2021 03:08:11 +0000
Subject: [php-src] Issue #7848: Uploaded files are owned by root, only after calling fileowner function correct owner is set
Groups: php.bugs 
Request: Send a blank email to php-bugs+get-238621@lists.php.net to get a copy of this message
Issue: https://github.com/php/php-src/issues/7848 Author: DevDavido ### Description The following code in a relatively minimal docker compose setup of PHP + nginx for reproduction: index.php: ```php <!DOCTYPE html> <html> <head><title>Upload your files</title></head> <body> <form enctype="multipart/form-data" action="index.php" method="POST"> <p>Upload your file</p> <input type="file" name="uploaded_file" /><br /> <input type="submit" value="Upload" /> </form> <?php error_reporting(E_ALL); clearstatcache(); file_put_contents("lorem", "ipsum"); var_dump(fileowner("lorem")); unlink("lorem"); if (!empty($_FILES['uploaded_file'])) { $path = './' . basename($_FILES['uploaded_file']['name']); if (move_uploaded_file($_FILES['uploaded_file']['tmp_name'], $path)) { echo "The file " . basename($_FILES['uploaded_file']['name']) . " has been uploaded"; } else { echo "There was an error uploading the file, please try again!"; } //var_dump(fileowner($path)); } ?> </body> </html> ``` docker-compose.yml ```yml services: web: image: nginx:latest ports: - "8080:80" volumes: - ./src:/var/www/html - ./default.conf:/etc/nginx/conf.d/default.conf links: - php-fpm php-fpm: image: php:8-fpm volumes: - ./src:/var/www/html ``` default.conf: ```conf server { index index.php; server_name phpfpm.local; error_log /var/log/nginx/error.log; access_log /var/log/nginx/access.log; root /var/www/html; location ~ \.php$ { try_files $uri =404; fastcgi_split_path_info ^(.+\.php)(/.+)$; fastcgi_pass php-fpm:9000; fastcgi_index index.php; include fastcgi_params; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; fastcgi_param PATH_INFO $fastcgi_path_info; } } ``` The uid of the temporary file lorem gets printed correctly (same as php-fpm worker process uid). When uploading a file through the form and checking within the PHP container its uid/gid like docker exec -it <container-name> ls -ls the file owner/group of the uploaded file is root/root. Only after removing the comment of the second var_dump with PHP's fileowner function and uploading a file again, the filesystem returns the correct file owner/group via docker exec -it <container-name> ls -ls. Not sure if this is related to PHP or any other involved services. Although only after calling fileowner the correct uid is returned of the uploaded file. ### PHP Version 8.x ### Operating System Debian 11

« previous php.bugs (#238621) next »