This comment in file_save_upload() seems to have been moved around within Drupal several times, to the point where I'm not sure where it originally came from back in the mists of time:

    // Move uploaded files from PHP's upload_tmp_dir to Drupal's temporary
    // directory. This overcomes open_basedir restrictions for future file
    // operations.
    $file->setFileUri($file->destination);
    if (!drupal_move_uploaded_file($file_info->getRealPath(), $file->getFileUri())) {

It's no longer correct, and is quite misleading; the uploaded file is being moved to its actual destination here rather than into Drupal's temporary directory.

I think we can see the patch which changed this functionality here: #115267-67: Simplify File Uploads, Centralize File Validation and Quotas, Fix File Previews....

There was subsequently some discussion about changing the way this works re. open_basedir in #357469: file_save_upload() fails to handle open_basedir restriction, however, based on the apparent lack of progress / discussion there it looks like Damien Tournoud was probably right to mark it as "Closed (won't fix)" (in #22), saying:

move_uploaded_file() is affected by open_basedir restrictions. That means that you have to make sure that the upload_tmp_dir is in the open_basedir paths for file uploads to work in any PHP application in the first place.

Note that there is also a relevant workaround in place in FileSystem::moveUploadedFile

So with that context, it looks like the comment about moving the uploaded file to Drupal's temp directory should be removed or at least updated.

CommentFileSizeAuthor
#2 2938853-2.patch706 bytesmcdruid
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

mcdruid created an issue. See original summary.

mcdruid’s picture

Status: Active » Needs review
FileSize
706 bytes

Patch which simply removes the comment; I'd argue the code that it precedes is clear enough.

mcdruid’s picture

Issue tags: +Documentation
anavarre’s picture

Status: Needs review » Reviewed & tested by the community

Looks sensible.

  • catch committed 8bf69b5 on 8.6.x
    Issue #2938853 by mcdruid: Remove outdated and misleading comment re....
catch’s picture

Version: 8.6.x-dev » 8.5.x-dev
Status: Reviewed & tested by the community » Fixed

Committed/pushed to 8.6.x and cherry-picked to 8.5.x. Thanks!

  • catch committed 803f974 on 8.5.x
    Issue #2938853 by mcdruid: Remove outdated and misleading comment re....

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.