support non “/tmp” upload dir
-
First, thanks for the great plugin ??
I discovered a bug: vcaching currently errors-out when attempting to generate varnish config files when the “upload_tmp_dir” is set to something other than “/tmp”.
PHP is commonly hardened by using an alternate dir for storing temporary files other than “/tmp” (and consequetently leaving it out of the “open_basedir” list)–since the “/tmp” directory is necessarily world-writable. For example, this hardening guide recommends setting “upload_tmp_dir = /var/lib/php/tmp_upload” in /etc/php.ini
* https://howtogetonline.com/how-to-harden-your-php-for-better-security.php
Unfortunately, the current version of vcaching.php has the lines:
$tmpfile = tempnam("tmp", "zip");
which errors-out with this
[Mon Nov 13 18:26:08.125913 2017] [:error] [pid 16227] [client 127.0.0.1:42956] PHP Warning: tempnam(): open_basedir restriction in effect. File(/tmp) is not within the allowed path(s): (/home/wp/.wp-cli:/usr/share/pear:/var/lib/php/tmp_upload:/var/lib/php/session:/var/www/html/) in /var/www/html/htdocs/wp-content/plugins/vcaching/vcaching.php on line 915, referer: https://mysite/wp-admin/index.php?page=vcaching-plugin&tab=conf [Mon Nov 13 18:26:08.125948 2017] [:error] [pid 16227] [client 127.0.0.1:42956] PHP Warning: ZipArchive::open(): Empty string as source in /var/www/html/htdocs/wp-content/plugins/vcaching/vcaching.php on line 917, referer: https://mysite/wp-admin/index.php?page=vcaching-plugin&tab=conf
The first argument to the “tempnam()” function should be changed to a variable, which is set to the result of the “sys_get_temp_dir()” function.
* https://secure.php.net/manual/en/function.sys-get-temp-dir.php
- The topic ‘support non “/tmp” upload dir’ is closed to new replies.