I recently had to make a mandatory change to the drupal file system setting temporary directory... we are electing not to use /tmp as the dir for file uploads. we are using open_basedir to prevent this. it seems, however, that despite the change, webfm does not recognize this, and continues to attempt to send files there. Is this hard coded, or should webfm be reading the tmp dir from the file system setting?

thanks!

Comments

nhck’s picture

nhck commented

In my opinion this is part of your php.ini, see upload_tmp_dir at http://php.net/manual/de/ini.core.php

jadowd’s picture

jadowd commented

thanks nhck. That answer doesn't work very well if you have multiple sites on a single server. The idea is to have all sites locked down so that their temp dir is within their own directory.

But the issue makes me wonder why there is even a value set for the temp dir in the file system admin section, if the system doesn't seem to use it? seems like maybe a core bug, unless it is just webfm that fails to access this setting.

I actually found the solution though, using open_basedir, it is important to add these directives into the site's apache conf... if you are using apache.

## lock file opens to web root:
php_admin_value open_basedir /path/to/your/doc/root
php_admin_value upload_tmp_dir /path/to/your/doc/root/plus-tmp

This way, drupal gets to do it's think when creating it's index.php file, and the upload_tmp_dir gets to be set on the fly, on a site by site basis.

nhck’s picture

nhck commented
Status: Active » Closed (works as designed)

Well it really depends on how you configure your server - if that is really a security risk I would run separate virtual machines.

Anyway its not a bug, neither in webfm, nor in core. As you have probably seen in the php-manual (http://www.php.net/manual/en/features.file-upload.post-method.php) you cannot set the tmp directory during upload because that would actually be a security-problem. So its always going to be a server-side setting. Which also means that basically any "upload" field is going to "safe" files to that directory.

I am not sure what all that drupal-setting is used for: As of now it basically holds the system set temporary directory path. I could think of image-generation-scripts and such that might want to utilize such a directory.