I am using IIS7 with PHP (FastCGI).

I set up the upload_tmp_dir to "X:\Temp" instead of leaving it empty, but it's still using "C:\Windows\Temp" for some reason.

I did give the following users full rights : NETWORK SERVICE, (application pool user), IIS_IUSRS. I also restarted IIS after I made the change.

I tried to create a directory inside the correct temp path using PHP, and that did work, so it's not a security issue.

Kind regards,

Matthias Vance


Look for the setting under Fopen wrappers section as well.

On my installation of PHP, I found another upload_tmp_dir lurking in there which takes precedence because it is specified after the setting under File uploads

I suspect that part of the installation process for the new Windows (.msi) installations of PHP try to be a little too clever and create these settings from the system environment variables at install time instead of asking you.

In short, look for duplicate upload_tmp_dir entries in your PHP file and eliminate them.

HTH Lewis

  • Good point, however, as stated before, it does show up right in phpinfo(), which means it does have the right value. – Thijs Tijsma Nov 29 '10 at 18:41

Sorry, but I am not understanding your question correctly.

If PHP is going to use System Environment variable for TEMP or TMP then it will point to %SystemRoot%\TEMP. But if there is any variable in PHP.ini which you can configure and point to a custom folder for the temporary files, then giving permissions should work. Check this out http://phpsec.org/projects/phpsecinfo/tests/upload_tmp_dir.html and http://www.php.net/manual/en/features.file-upload.php

If PHP is still using %SystemRoot%\TEMP, then use Process Monitor and check at what stage the application redirect's to the %SystemRoot%\TEMP folder. Hopefully this should be a simple configuration issue.

  • There is a configuration directive 'upload_tmp_dir' which I set in PHP.ini, and is being recognized, as I can see when I execute a phpinfo() call. PHP can write to the directory just fine, it just doesn't put the uploaded files there. I'll use a file system monitoring tool to check whether or not any security issues occur. (I do believe I have all the security settings right). – Thijs Tijsma Mar 31 '10 at 17:45

PHP is ignoring the upload_tmp_dir because of one setting on APPLICATION POOLS.

It's not php-cgi.exe, php.ini, or a permissions issue.

Go to the application pool of the website experiencing the issue:

  1. Right click
  2. Select Advanced settings
  3. Scroll to LOAD USER PROFILE and set it to FALSE.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.