Last modified: 2013-09-04 11:49:48 UTC

Wikimedia Bugzilla is closed!

Wikimedia migrated from Bugzilla to Phabricator. Bug reports are handled in Wikimedia Phabricator.
This static website is read-only and for historical purposes. It is not possible to log in and except for displaying bug reports and their history, links might be broken. See T26898, the corresponding Phabricator task for complete and up-to-date bug report information.
Bug 24898 - MediaWiki uses /tmp even if a vHost-specific tempdir is set
MediaWiki uses /tmp even if a vHost-specific tempdir is set
Status: RESOLVED FIXED
Product: MediaWiki
Classification: Unclassified
History/Diffs (Other open bugs)
1.17.x
Other other
: Normal major (vote)
: ---
Assigned To: Nobody - You can work on this!
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2010-08-21 19:04 UTC by Christian Boltz
Modified: 2013-09-04 11:49 UTC (History)
2 users (show)

See Also:
Web browser: ---
Mobile Platform: ---
Assignee Huggle Beta Tester: ---


Attachments

Description Christian Boltz 2010-08-21 19:04:17 UTC
My apache config contains for every virtual host a line like this:
   SetEnv TMP /home/www/example.com/tmp/
to have tempfiles in a directory specific to each virtual host.

Unfortunately MediaWiki ignores $TMP and always uses /tmp. AFAIK this behaviour was introduced in 1.16 - I did not notice it in 1.15.

The bug is in includes/GlobalFunctions.php:

function wfTempDir() {
    if( function_exists( 'sys_get_temp_dir' ) ) {
        return sys_get_temp_dir();
    }
    foreach( array( 'TMPDIR', 'TMP', 'TEMP' ) as $var ) {
        $tmp = getenv( $var );
        if( $tmp && file_exists( $tmp ) && is_dir( $tmp ) && is_writable( $tmp ) ) {
            return $tmp;
        }
    }
    # Hope this is Unix of some kind!
    return '/tmp';
}


Basically the function does the checks in the wrong order. On PHP >= 5.2.1 sys_get_temp_dir() exists and will always return /tmp - it ignores $TMP, see the comments on http://php.net/sys_get_temp_dir

The correct order would be:
1. $TMPDIR, $TMP, $TEMP
2. sys_get_temp_dir()
3. /tmp fallback


Patch: (3 lines moved)


--- includes/GlobalFunctions.php        (Revision 71214)
+++ includes/GlobalFunctions.php        (Arbeitskopie)
@@ -2137,15 +2137,15 @@
  * @return String
  */
 function wfTempDir() {
-       if( function_exists( 'sys_get_temp_dir' ) ) {
-               return sys_get_temp_dir();
-       }
        foreach( array( 'TMPDIR', 'TMP', 'TEMP' ) as $var ) {
                $tmp = getenv( $var );
                if( $tmp && file_exists( $tmp ) && is_dir( $tmp ) && is_writable( $tmp ) ) {
                        return $tmp;
                }
        }
+       if( function_exists( 'sys_get_temp_dir' ) ) {
+               return sys_get_temp_dir();
+       }
        # Hope this is Unix of some kind!
        return '/tmp';
 }


Rating as major because it causes some "interesting" problems - open_basedir restrictions or in my case AppArmor restrictions might apply.

Sidenote: The code trusts sys_get_temp_dir() blindly - it does not check if it exists, is a directory and is writeable. Maybe you should add a check for this, similar to the code used for $TMPDIR/$TMP/$TEMP. (This is NOT included in the above patch.)
Comment 1 Chad H. 2010-08-23 01:57:39 UTC
Fixed in trunk in r71457.
Comment 2 admin 2011-09-08 14:54:33 UTC
I have problem with this function. My apache config not contains for every virtual host a line like this:
   SetEnv TMP /home/www/example.com/tmp/

And i have situation when:
getenv( $var ) - return empty (define('TMP', "/home/user/mod-tmp/") not workin)
sys_get_temp_dir() - return /tmp (not workin because open_basedir /home/user)

Error:

Warning:  tempnam() [function.tempnam]: open_basedir restriction in effect. File(/tmp) is not within the allowed path(s): (/home/user:.) in /home/user/www/site.com/includes/upload/UploadFromUrl.php on line 98

I add to LocalSettings.php line:

   $wgTmpDirectory     = "/home/user/mod-tmp/";

but in this function, this variable is not taken into account

MediaWiki version 1.17.0
PHP 5.2.10

In MediaWiki version 1.16.5 we have

   $localFile = tempnam( $wgTmpDirectory, 'WEBUPLOAD' );

and it works.


(Google Translate)

Note You need to log in before you can comment on or make changes to this bug.


Navigation
Links