Plugin hard-codes mpdf tempdir to potenitally non-writeable location

Hello Ronny,

thanks for your message and the complete explanation.

I opened a task for the dev team and I’ll let you know as soon as they’ll reply.

Could you please send me the url of the website for which you’re using Complianz? Or just one of them if you manage multiple websites.

Of course. This site in particular is https://www.bradymemorymap.co.uk/

Thanks.

Ronny

Hello,

thanks for the information.

The check has been scheduled for the 25th-26th of July, I’ll let you know as soon as the dev team will send me an update.

Hi,

Any update to this?

Thanks.

Hello,

unfortunately we don’t have an update about it, we’ll inform you as soon as the dev team will release an update.

Thanks for your patience

Hello,

could you please update our plugin, delete the website cache and check if the issue is still there?

There doesn’t appear to be an update available. Latest version is v7.1.0.

Hi @ronnyadsetts, are you a Premium/PRO user?

In this case, due to WP guidelines, feel free to write us to [email protected]

In that case we can give you a testable version of the premium plugin to solve this issue.

Thank you for your cooperation

Not a Premium/Pro user. If I was, I wouldn’t be posting for support here would I?

Thank you for your confirmation,

we really want to be compliant with WP Guidelines, and we wanted to be sure.

We’ll try to fix this in the free version of the plugin and we’ll keep you posted

OK. Thanks for the update.

Look forward to seeing a fix as the periodic stack-traces are a bit annoying.

Hi,

the dev team told us the possible solution related to the issue you pointed out, we’re evaluating how to send you all the steps to follow together with the testable version of our plugin.

Hello,

thanks for your patience.

Here you can download the testable version of the free plugin, below you’ll find all the steps you can follow to test the solution.

Testing the Solution, Steps Taken to Test the Applied Solution

Install the Plugin

• Download and install the plugin on the WordPress site.

Generate Proof of Consent

• On the frontend of the website, interact with the cookie consent banner to accept cookies and generate proof of consent entries.

Generate Proof of Consent PDF

• Go to Complianz > Tools > Record of Consent in the WordPress admin panel.
• Click on the Generate button to create a PDF document of the consent records.

Normal Installation Testing

• Default Temporary Directory (tempDir) Handling:
  • Verify that the mPDF cache is generated in a subdirectory under wp-content/uploads/complianz/snapshots/tmp.
  • After generating the PDF, confirm that the default temporary directory is automatically deleted, ensuring no leftover temporary files.

Locked Installations Testing

• Custom Temporary Directory (tempDir) Handling:
  • For installations with restricted directory permissions (“locked installations”):
    • Use the filter cmplz_mpdf_args to set a custom tempDir path.
    • Use the filter described in the section below “Test using a custom tempDir…”
      • Create a new mu-plugin
      • Add the code taking care to pass a new path to the $args[‘tempDir’]
    • Ensure that temporary mPDF files are correctly created in the specified custom path.
    • Verify that these temporary files are deleted after the PDF generation, preventing storage of unnecessary temporary data.

Note

Test using a custom tempDir, the attached snippet filters the cmplz_mpdf_args arguments:

<?php
/**
* Plugin Name: Override CMPLZ mPDF tempdir
* Description: Override the tempdir for mPDF to the uploads directory.
*/
// Basic security, prevents file from being loaded directly.
defined('ABSPATH') or die("you do not have access to this page!");
if (!has_filter('cmplz_mpdf_args', 'override_cmplz_mpdf_args')) {
function override_cmplz_mpdf_args($args)
{
// Set the tempdir to the uploads directory
$uploads = wp_upload_dir();
$upload_dir = $uploads['basedir'];
$new_temp_dir = $upload_dir . '/tmp-mpdf';
$args['tempDir'] = $new_temp_dir;

return $args;
}
add_filter('cmplz_mpdf_args', 'override_cmplz_mpdf_args', 10, 1);
}

This appears to work as expected. I wasn’t able to verify the creation of the tmp dir. I think it’s removed in the recursively_clear_directory() function. Perhaps it shouldn’t be – it’s needed every time a PDF is created.

I’ll update the ticket if I find anything else but this looks fixed to me.

Thanks.

Hello,

thanks a lot for your patience and your feedback.

We’ll be at your disposal if you’ll need more help in the future.

Have a nice day!