Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

LS,

I am using IIS7 with PHP (FastCGI).

I set up the upload_tmp_dir to "X:\Temp" instead of leaving it empty, but it's still using "C:\Windows\Temp" for some reason.

I did give the following users full rights : NETWORK SERVICE, (application pool user), IIS_IUSRS. I also restarted IIS after I made the change.

I tried to create a directory inside the correct temp path using PHP, and that did work, so it's not a security issue.

Kind regards,

Matthias Vance

share|improve this question

2 Answers 2

Look for the setting under Fopen wrappers section as well.

On my installation of PHP, I found another upload_tmp_dir lurking in there which takes precedence because it is specified after the setting under File uploads

I suspect that part of the installation process for the new Windows (.msi) installations of PHP try to be a little too clever and create these settings from the system environment variables at install time instead of asking you.

In short, look for duplicate upload_tmp_dir entries in your PHP file and eliminate them.

HTH Lewis

share|improve this answer
    
Good point, however, as stated before, it does show up right in phpinfo(), which means it does have the right value. –  user215361 Nov 29 '10 at 18:41
    
That helped in my case. Thanks! –  Olaf Nov 15 '12 at 15:42

Sorry, but I am not understanding your question correctly.

If PHP is going to use System Environment variable for TEMP or TMP then it will point to %SystemRoot%\TEMP. But if there is any variable in PHP.ini which you can configure and point to a custom folder for the temporary files, then giving permissions should work. Check this out http://phpsec.org/projects/phpsecinfo/tests/upload_tmp_dir.html and http://www.php.net/manual/en/features.file-upload.php

If PHP is still using %SystemRoot%\TEMP, then use Process Monitor and check at what stage the application redirect's to the %SystemRoot%\TEMP folder. Hopefully this should be a simple configuration issue.

share|improve this answer
    
There is a configuration directive 'upload_tmp_dir' which I set in PHP.ini, and is being recognized, as I can see when I execute a phpinfo() call. PHP can write to the directory just fine, it just doesn't put the uploaded files there. I'll use a file system monitoring tool to check whether or not any security issues occur. (I do believe I have all the security settings right). –  user215361 Mar 31 '10 at 17:45

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.