PHP ignores upload_tmp_dir?

Question

LS,

I am using IIS7 with PHP (FastCGI).

I set up the upload_tmp_dir to "X:\Temp" instead of leaving it empty, but it's still using "C:\Windows\Temp" for some reason.

I did give the following users full rights : NETWORK SERVICE, (application pool user), IIS_IUSRS. I also restarted IIS after I made the change.

I tried to create a directory inside the correct temp path using PHP, and that did work, so it's not a security issue.

Kind regards,

Matthias Vance

Solution

Look for the setting under Fopen wrappers section as well.

On my installation of PHP, I found another upload_tmp_dir lurking in there which takes precedence because it is specified after the setting under File uploads

I suspect that part of the installation process for the new Windows (.msi) installations of PHP try to be a little too clever and create these settings from the system environment variables at install time instead of asking you.

In short, look for duplicate upload_tmp_dir entries in your PHP file and eliminate them.

HTH Lewis

Comments

[Thijs Tijsma]

There is a configuration directive 'upload_tmp_dir' which I set in PHP.ini, and is being recognized, as I can see when I execute a phpinfo() call. PHP can write to the directory just fine, it just doesn't put the uploaded files there. I'll use a file system monitoring tool to check whether or not any security issues occur. (I do believe I have all the security settings right).

[Thijs Tijsma]

Good point, however, as stated before, it does show up right in phpinfo(), which means it does have the right value.