Edit report at https://bugs.php.net/bug.php?id=55804&edit=1
ID: 55804
Updated by: paj...@php.net
Reported by: spam2 at rhsoft dot net
Summary: tempnam(): wrong fallback to /tmp
Status: Open
Type: Bug
Package: Safe Mode/open_basedir
Operating System: Linux
PHP Version: 5.3.8
Block user comment: N
Private report: N
New Comment:
if the files are not removed on request or sapi shutdown, then we have a bug.
Previous Comments:
------------------------------------------------------------------------
[2011-09-28 09:13:01] spam2 at rhsoft dot net
> Documented behavior, changing it will break BC
what sort of BC?
the created file is outside open_basedir, can not be used and can not be deleted
so this file is useless and simply at the wrong location
i can not imagine any code which useful relies on that "feature"
------------------------------------------------------------------------
[2011-09-28 09:09:51] paj...@php.net
Documented behavior, changing it will break BC.
To correctly configure the temp directory in each host is a the way to go for
now.
------------------------------------------------------------------------
[2011-09-28 09:05:35] spam2 at rhsoft dot net
Description:
------------
tempnam() should NOT fall back to /tmp if the $dir-param is explicit set to a
real-path inside the open_basedir and because of wrong permissions $dir is not
writeable
Test script:
---------------
<?php
$temp_folder = dirname(__FILE__) . '/temp/';
mkdir($temp_folder);
chmod($temp_folder, 0555);
$tmp_name = str_replace("\\", '/', tempnam($temp_folder, 'rhcsv'));
$fp = fopen($tmp_name, 'wb+');
if($fp)
{
flock($fp, LOCK_EX);
fwrite($fp, 'test');
flock($fp, LOCK_UN);
fclose($fp);
}
?>
Expected result:
----------------
error message that $dir is not writeable
Actual result:
--------------
temporary file is created in /tmp which violates open_basedir and fopen() is
failing with open_basedir restriction messages
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=55804&edit=1
