up vote 2 down vote favorite
share [g+] share [fb]

LS,

I am using IIS7 with PHP (FastCGI).

I set up the upload_tmp_dir to "X:\Temp" instead of leaving it empty, but it's still using "C:\Windows\Temp" for some reason.

I did give the following users full rights : NETWORK SERVICE, (application pool user), IIS_IUSRS. I also restarted IIS after I made the change.

I tried to create a directory inside the correct temp path using PHP, and that did work, so it's not a security issue.

Kind regards,

Matthias Vance

link|improve this question
feedback

2 Answers

up vote 0 down vote

Sorry, but I am not understanding your question correctly.

If PHP is going to use System Environment variable for TEMP or TMP then it will point to %SystemRoot%\TEMP. But if there is any variable in PHP.ini which you can configure and point to a custom folder for the temporary files, then giving permissions should work. Check this out http://phpsec.org/projects/phpsecinfo/tests/upload_tmp_dir.html and http://www.php.net/manual/en/features.file-upload.php

If PHP is still using %SystemRoot%\TEMP, then use Process Monitor and check at what stage the application redirect's to the %SystemRoot%\TEMP folder. Hopefully this should be a simple configuration issue.

link|improve this answer
There is a configuration directive 'upload_tmp_dir' which I set in PHP.ini, and is being recognized, as I can see when I execute a phpinfo() call. PHP can write to the directory just fine, it just doesn't put the uploaded files there. I'll use a file system monitoring tool to check whether or not any security issues occur. (I do believe I have all the security settings right). – Matthias Vance Mar 31 '10 at 17:45
feedback
up vote 0 down vote

Look for the setting under Fopen wrappers section as well.

On my installation of PHP, I found another upload_tmp_dir lurking in there which takes precedence because it is specified after the setting under File uploads

I suspect that part of the installation process for the new Windows (.msi) installations of PHP try to be a little too clever and create these settings from the system environment variables at install time instead of asking you.

In short, look for duplicate upload_tmp_dir entries in your PHP file and eliminate them.

HTH Lewis

link|improve this answer
Good point, however, as stated before, it does show up right in phpinfo(), which means it does have the right value. – Matthias Vance Nov 29 '10 at 18:41
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.