Bug #70106

Temporary files are not deleted even though GeneralUtility::unlink_tempfile is called

Added by Matteo Bonaker over 4 years ago. Updated over 1 year ago.

Status:
Closed
Priority:
Should have
Assignee:
-
Category:
-
Target version:
-
Start date:
2015-09-25
Due date:
% Done:

100%

TYPO3 Version:
6.2
PHP Version:
5.3
Tags:
GeneralUtility, temporory, tmp, temp, typo3temp, symlink
Complexity:
Is Regression:
No
Sprint Focus:

Description

If you have the following file structure (e.g. Mittwald has this) with PATH_site being /home/www/p123456/html/typo3/ ...

DIR     /html/typo3/
DIR     /html/typo3/typo3temp/
SYMLINK /home/www/p123456/ -> ../.. ("../.." refers to the server root /)
LINKED  /home/www/p123456/html/ -> /html/
LINKED  /home/www/p123456/html/typo3/ -> /html/typo3/ (this is what PATH_site contains)
LINKED  /home/www/p123456/html/typo3/typo3temp/ -> /html/typo3/typo3temp/

... then the following code will create a temporary file but will not delete it again!

$tmpFile = GeneralUtility::tempnam('test', '.txt'); //$tmpFile == '/html/typo3/typo3temp/testABCDE.txt'
GeneralUtility::unlink_tempfile($tmpFile);

This is because GeneralUtility::tempnam uses PHP's tempnam and PHP's tempnam seems to use something like realpath internally which resolves symlinks. So you end up with a $tmpFile-path that contains no unresolved symlinks. But GeneralUtility::unlink_tempfile expects the first parameter to start with exactly PATH_site (containing unresolved symlinks).

In the end either GeneralUtility::tempnam or GeneralUtility::unlink_tempfile needs to be adjusted. I personally think it would be much better to fix GeneralUtility::tempnam, because it should not return anything that does not begin with PATH_site in my opinion. Maybe something like this inside GeneralUtility::tempnam would fix it:

if(!self::isFirstPartOfStr($uploadedTempFileName, PATH_site . 'typo3temp/')) {
  $tempFileName = PATH_site . 'typo3temp' . substr(realpath($tempFileName), strlen(realpath(PATH_site . 'typo3temp')));
}


Related issues

Duplicated by TYPO3 Core - Bug #78555: "Add media by URL" does not work on our Servers Closed 2016-11-03
Duplicated by TYPO3 Core - Bug #79032: Youtube & Vimeo content elements doesn't work properly in surf deployed projects Closed 2016-12-19
Duplicated by TYPO3 Core - Bug #75395: EXT:form – attachments from fileupload missing in mail because of isAllowedAbsPath Closed 2016-04-04

Associated revisions

Revision fe23a0b0 (diff)
Added by Stefan Froemken about 3 years ago

[BUGFIX] Do not use realpath for temporary file names

Generating a temporary file with the PHP function tempnam,
returns the realpath of the file. There are however
situations where PATH_site has some symlinks or mounts, thus
comparing those paths will fail.

Instead of just using the path the function returns, we only
use the filename and prefix that with PATH_site, so that
the check if the temporary path is within PATH_site will succeed.

Resolves: #70106
Releases: master, 7.6, 6.2
Change-Id: I39a1830ff1a5791aa3fdc91056e3870fbb6dde1f
Reviewed-on: https://review.typo3.org/50490
Tested-by: TYPO3com <>
Reviewed-by: Alexander Krist <>
Tested-by: Alexander Krist <>
Reviewed-by: Daniela Grammlich <>
Tested-by: Daniela Grammlich <>
Reviewed-by: Joerg Boesche <>
Reviewed-by: Alexander Stehlik <>
Tested-by: Alexander Stehlik <>
Reviewed-by: Markus Klein <>
Reviewed-by: Helmut Hummel <>
Tested-by: Helmut Hummel <>

Revision b35192a0 (diff)
Added by Stefan Froemken about 3 years ago

[BUGFIX] Do not use realpath for temporary file names

Generating a temporary file with the PHP function tempnam,
returns the realpath of the file. There are however
situations where PATH_site has some symlinks or mounts, thus
comparing those paths will fail.

Instead of just using the path the function returns, we only
use the filename and prefix that with PATH_site, so that
the check if the temporary path is within PATH_site will succeed.

Resolves: #70106
Releases: master, 7.6, 6.2
Change-Id: I39a1830ff1a5791aa3fdc91056e3870fbb6dde1f
Reviewed-on: https://review.typo3.org/51083
Reviewed-by: Helmut Hummel <>
Tested-by: Helmut Hummel <>

Revision 7a993251 (diff)
Added by Stefan Froemken about 3 years ago

[BUGFIX] Do not use realpath for temporary file names

Generating a temporary file with the PHP function tempnam,
returns the realpath of the file. There are however
situations where PATH_site has some symlinks or mounts, thus
comparing those paths will fail.

Instead of just using the path the function returns, we only
use the filename and prefix that with PATH_site, so that
the check if the temporary path is within PATH_site will succeed.

Resolves: #70106
Releases: master, 7.6, 6.2
Change-Id: I39a1830ff1a5791aa3fdc91056e3870fbb6dde1f
Reviewed-on: https://review.typo3.org/51086
Reviewed-by: Helmut Hummel <>
Tested-by: Helmut Hummel <>
Tested-by: TYPO3com <>

History

#1 Updated by Matteo Bonaker over 4 years ago

Simpler suggestion for the change inside GeneralUtility::tempnam:

$tempFileName = PATH_site . 'typo3temp/' . basename($tempFileName);

But keep in mind, that PHP's tempnam might fall back on the system default if it has no access rights to the temp-directory which would be a problem anyway.

#2 Updated by Gerrit Code Review about 3 years ago

  • Status changed from New to Under Review

Patch set 4 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/50490

#3 Updated by Gerrit Code Review about 3 years ago

Patch set 5 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/50490

#4 Updated by Stefan Froemken about 3 years ago

  • Status changed from Under Review to Resolved
  • % Done changed from 0 to 100

#5 Updated by Gerrit Code Review about 3 years ago

  • Status changed from Resolved to Under Review

Patch set 1 for branch TYPO3_7-6 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/51083

#6 Updated by Stefan Froemken about 3 years ago

  • Status changed from Under Review to Resolved

#7 Updated by Gerrit Code Review about 3 years ago

  • Status changed from Resolved to Under Review

Patch set 1 for branch TYPO3_6-2 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/51086

#8 Updated by Stefan Froemken about 3 years ago

  • Status changed from Under Review to Resolved

#9 Updated by Benni Mack over 1 year ago

  • Status changed from Resolved to Closed

Also available in: Atom PDF