PHP 4.0 Bug #6875 Updated: upload_tmp_dir in php.ini doesn't work in safe_mode

ID: 6875 Updated by: sniper Reported By: sintes@nfrance.com Status: Duplicate Bug Type: *General Issues Assigned To: Comments: Duplicate of #5575 (on one part of it). Previous Comments: --------------------------------------------------------------------------- [2000-09-24 23:14:56] sintes@nfrance.com Tested with: -------------- - php 4.0.2 on Linux 2.2.17 - php 4.0.3RC1 on Linux 2.2.17 - php 4.0.3RC1 on OpenBSD 2.7 - php 4.0.3RC1 on OpenBSD 2.8 Snap Work's fine with Php4.0.1pl2 on all operating system tested. './configure' '--with-pgsql=/usr/local' '--with-mysql=/usr/local' '--with-imagic' '--with-imap' '--enable-track-vars' '--enable-safe-mode' '--enable-memory-limit' '--enable-magic-quotes' '--enable-roxen-zts' '--with-gd=/usr/' '--with-t1lib' '--with-cpdflib' '--enable-ftp' '--enable-calendar' '--with-gdbm' '--enable-zlib=/usr/' '--with-gettext' '--with-mcrypt=/usr/local' '--with-xml' '--with-dom' '--with-swf' '--with-apache=/usr/local/src/apache_1.3.12' Tried also with just the --enable-safe-mode option. ----------------------------------------------------------- php.ini with all defaults except following: safe_mode = On safe_mode_exec_dir = "/safe-bin" safe_mode_allowed_env_vars = PHP_,HTTP_POST upload_tmp_dir = ./tmp-php/ The simple script: --------------------- <form enctype="multipart/form-data" method="post" action="upload.php"> <input type="file" name="fichier"> <input type="submit"> </form> and upload.php copy ("$fichier","upload/$fichier_name"); tmp-php and upload are in 777. Owner is the same that the file upload.php3. The script return the following ----------------------------------- Warning SAFE MODE Restriction in effect. The script whose uid is 504 is not allowed to access /tmp/phpYmZddQ owned by uid 0 in /home/dh/html/upload.php3 on line 8wing: * Note that php try to access to /tmp/php* not to ./tmp-php/php* phpinfo returns: ------------------ in configuration section: ---------------------------- upload_tmp_dir ./tmp-php/ ./tmp-php/ But in PHP Variable section: --------------------------------- PHP Variables Variable Value PHP_SELF /upload.php3 HTTP_POST_FILES["fichier"] Array ( [name] => toto [type] => [tmp_name] => /tmp/phpYmZddQ [size] => 469 ) It seems the problem occurs since the $HTTP_POST_FILES[filename][tmp_name] has been added. * No problem with php4.0.1pl2. --------------------------------------------------------------------------- Full Bug description available at: http://bugs.php.net/?id=6875