search

contao / contao-manager

Contao Manager
GNU Lesser General Public License v3.0
86 stars 33 forks source link

The SysTempDirCheck does not check if it can write subdirectories #569

Closed Toflar closed 4 years ago

Toflar commented 4 years ago

This might lead to issues such as https://github.com/contao/contao/issues/1813.

However, creating subdirectories in /tmp must be allowed for everyone. Go check your personal temporary directory on your OS, I'm sure you'll probably find even more directories than you'll find files.

Also, there's many sources for this, just search the Internet for "correct permissions for tmp directory" but here's one for you: https://www.thegeekdiary.com/unix-linux-what-is-the-correct-permission-of-tmp-and-vartmp-directories/

Also, checking out the code of SysTempDirCheck.php I'm not sure if the current error message is correct. It seems like it outputs information related to open_basedir. However, that is just one use case. It might also be the case that the configured temporary directory just does not have the correct rights. The open_basedir check should be separate from it. So imho

  1. Check if a file can created in sys_get_temp_dir()
  2. Check if a file can be written to in sys_get_temp_dir()
  3. Check if a directory can be created in sys_get_temp_dir()
  4. Check if a file can be written to that created directory

If any of those checks fail:

  1. Split the open_basedir paths (:) and check if they match sys_get_temp_dir(). If not, the configuration of open_basedir is wrong.
  2. Otherwise the permissions of the temporary directory seem to be wrong.

/cc @ausi