Download files and open_basedir: why you should use standard functions
It would seem that the issue of uploading files to the server is sucked to the bone, but one recent event made me doubt this.
Some time ago, in order to increase security on our servers, the PHP setting open_basedir was enabled. After that, many PHP applications stopped uploading files to the server.
According to the link there are a lot of letters (which are still recommended to be read), here I will write briefly:
After enabling this setting on our servers, the scripts were “locked” inside the directory of their site (virtual host). Files continued to be loaded into the directory for temporary files, which was located on another section and was not included in the directory tree of the site. Accordingly, all scripts that tried to access the uploaded files through the tmp_name element of the $ _FILES variable failed.
')
Of course, the PHP language is developed by intelligent people, so the open_basedir action does not apply to the is_uploaded_file and move_uploaded_file functions , which, in fact, are designed to work with downloaded files.
So what's the problem then? And the problem is this: many ( indeed many! ) Refer directly to the uploaded files, bypassing the standard functions .
This is usually done in cases where the downloaded file is not supposed to be stored on the site. As a rule, this is the import of price lists (csv, xls), pictures that are converted before being saved in the file tree of the site. Often $ _FILES is used to check the loaded image (getimagesize) before calling move_uploded_file.
I strongly advise PHP programmers (especially beginners), first, not to neglect the use of standard functions. If the function is written, then it means something is needed. Secondly, carefully study the settings of PHP and its modes of operation. This will help to avoid such mistakes.
PS Someone can say "you are not figuring to configure the server so that the scripts stop working". However, I believe that if there is a setting, then someone will definitely use it. And if your program stops working after that, the stones will fly into you. Do you (we) need it?
Some time ago, in order to increase security on our servers, the PHP setting open_basedir was enabled. After that, many PHP applications stopped uploading files to the server.
According to the link there are a lot of letters (which are still recommended to be read), here I will write briefly:
- open_basedir limits the list of files that PHP can access to by the specified directory tree .
- open_basedir can be used regardless of whether protected mode is used or not .
After enabling this setting on our servers, the scripts were “locked” inside the directory of their site (virtual host). Files continued to be loaded into the directory for temporary files, which was located on another section and was not included in the directory tree of the site. Accordingly, all scripts that tried to access the uploaded files through the tmp_name element of the $ _FILES variable failed.
')
Of course, the PHP language is developed by intelligent people, so the open_basedir action does not apply to the is_uploaded_file and move_uploaded_file functions , which, in fact, are designed to work with downloaded files.
So what's the problem then? And the problem is this: many ( indeed many! ) Refer directly to the uploaded files, bypassing the standard functions .
This is usually done in cases where the downloaded file is not supposed to be stored on the site. As a rule, this is the import of price lists (csv, xls), pictures that are converted before being saved in the file tree of the site. Often $ _FILES is used to check the loaded image (getimagesize) before calling move_uploded_file.
I strongly advise PHP programmers (especially beginners), first, not to neglect the use of standard functions. If the function is written, then it means something is needed. Secondly, carefully study the settings of PHP and its modes of operation. This will help to avoid such mistakes.
PS Someone can say "you are not figuring to configure the server so that the scripts stop working". However, I believe that if there is a setting, then someone will definitely use it. And if your program stops working after that, the stones will fly into you. Do you (we) need it?
Source: https://habr.com/ru/post/51485/
All Articles