note 70232 rejected from features.file-upload by betz

Note Submitter: keuleu at hotmail dot com ---- I recently read a chapter about Uploading Files in a PHP book. The author was trying to explain why it is important to check that a file was indeed uploaded with the is_uploaded_file() function, before trying to include it in any process. While I understand the concept of arbitrary file disclosure, the example he chose is confusing me. The scenario involves a user who, instead of browsing through files before selecting one for upload as he is expected to do, would manually type '/etc/passwd' in the upload field of the form and submit it. If I understand well the value of $_FILES['name'] would then be '/etc/passwd'. But how would an attacker have access to the server's /etc/passwd file if you execute the following script right after the upload attempt with no checking or validation: <?php copy($_FILES['filename']['tmp_name'],"/www/htdocs/[public access directory]/'.basename($inputfieldname)); ?> The author claims that the result would be that the /etc/passwd would then be made publicly available. I really don't see how. How relevant to the server is the file path that we send with the form file input element? Does php rely on that value to find files or is it something only the client is concerned about? My belief was that this value was stored on $_FILES['name'] for informational purpose only (e.g. if we need to give a name to the file later on or want to store it in a db), but just like ['type'] it's not a safe value to rely on for manipulation. As for ['tmp_name'], it's the name for the temporary copy of the file in a designated directory. How in the hell would copy() get to /etc/passwd? I'm not saying that it's not possible, but if it is, for the sake of really understanding how this whole thing works I would really like to know.