note 70232 added to features.file-upload

I recently read a chapter about Uploading Files in a PHP book. The author was trying to explain why it is important to check that a file was indeed uploaded with the is_uploaded_file() function, before trying to include it in any process. While I understand the concept of arbitrary file disclosure, the example he chose is confusing me. The scenario involves a user who, instead of browsing through files before selecting one for upload as he is expected to do, would manually type '/etc/passwd' in the upload field of the form and submit it. If I understand well the value of $_FILES['name'] would then be '/etc/passwd'. But how would an attacker have access to the server's /etc/passwd file if you execute the following script right after the upload attempt with no checking or validation: <?php copy($_FILES['filename']['tmp_name'],"/www/htdocs/[public access directory]/'.basename($inputfieldname)); ?> The author claims that the result would be that the /etc/passwd would then be made publicly available. I really don't see how. How relevant to the server is the file path that we send with the form file input element? Does php rely on that value to find files or is it something only the client is concerned about? My belief was that this value was stored on $_FILES['name'] for informational purpose only (e.g. if we need to give a name to the file later on or want to store it in a db), but just like ['type'] it's not a safe value to rely on for manipulation. As for ['tmp_name'], it's the name for the temporary copy of the file in a designated directory. How in the hell would copy() get to /etc/passwd? I'm not saying that it's not possible, but if it is, for the sake of really understanding how this whole thing works I would really like to know. ---- Server IP: 216.235.15.211 Probable Submitter: 216.99.40.78 ---- Manual Page -- http://www.php.net/manual/en/features.file-upload.php Edit -- https://master.php.net/note/edit/70232 Del: integrated -- https://master.php.net/note/delete/70232/integrated Del: useless -- https://master.php.net/note/delete/70232/useless Del: bad code -- https://master.php.net/note/delete/70232/bad+code Del: spam -- https://master.php.net/note/delete/70232/spam Del: non-english -- https://master.php.net/note/delete/70232/non-english Del: in docs -- https://master.php.net/note/delete/70232/in+docs Del: other reasons-- https://master.php.net/note/delete/70232 Reject -- https://master.php.net/note/reject/70232 Search -- https://master.php.net/manage/user-notes.php