Package home | Report new bug | New search | Development Roadmap Status: Open | Feedback | All | Closed Since Version 0.9.4

Bug #9511 Shared /tmp dir assumed
Submitted: 2006-11-30 15:51 UTC
From: warrenklint at gmail dot com Assigned: dufuz
Status: Closed Package: Spreadsheet_Excel_Writer (version 0.9.1)
PHP Version: 5.1.2 OS: Ubuntu Dapper LTS
Roadmaps: (Not assigned)    
Subscription  


 [2006-11-30 15:51 UTC] warrenklint at gmail dot com (Warren Klint)
Description: ------------ We use open_basedir to prevent users accidentally sharing cookies and temporary files between websites. Each site has their own temporary dir nearer their docroot. This works really well, apart from with Spreadsheet_Excel_Writer. The problem is here: function _initialize() { // Open tmp file for storing Worksheet data $fh = tmpfile(); if ($fh) { // Store filehandle $this->_filehandle = $fh; } else { // If tmpfile() fails store data in memory $this->_using_tmpfile = false; } } There are two problems. The default value for _using_tmpfile, at the beginning of the class, is ignored. The value will always be true. Allowing a check for the method _using_tmpfile first would solve this: function _initialize() { if ($this->_using_tmpfile == false) { return; } // Open tmp file for storing Worksheet data $fh = tmpfile(); if ($fh) { // Store filehandle $this->_filehandle = $fh; } else { // If tmpfile() fails store data in memory $this->_using_tmpfile = false; } } The second problem is specific to sites which use a shared filesytem for thee data. Because tmpfile() will return something under "/tmp/", and "/tmp/" is disallowed by open_basedir, php kills the script before it gets a chance to work. Switching from tmpfile() to tempnam() fixes this. OLE/PPS/File.php also does this.

Comments

 [2007-08-15 23:56 UTC] User who submitted this comment has not confirmed identity
If you submitted this note, check your email.If you do not have a message, click here to re-send
MANUAL CONFIRMATION IS NOT POSSIBLE.  Write a message to pear-dev@lists.php.net
to request the confirmation link.  All bugs/comments/patches associated with this

email address will be deleted within 48 hours if the account request is not confirmed!
 [2008-08-25 09:10 UTC] User who submitted this comment has not confirmed identity
If you submitted this note, check your email.If you do not have a message, click here to re-send
MANUAL CONFIRMATION IS NOT POSSIBLE.  Write a message to pear-dev@lists.php.net
to request the confirmation link.  All bugs/comments/patches associated with this

email address will be deleted within 48 hours if the account request is not confirmed!
 [2009-11-13 06:53 UTC] User who submitted this comment has not confirmed identity
If you submitted this note, check your email.If you do not have a message, click here to re-send
MANUAL CONFIRMATION IS NOT POSSIBLE.  Write a message to pear-dev@lists.php.net
to request the confirmation link.  All bugs/comments/patches associated with this

email address will be deleted within 48 hours if the account request is not confirmed!