Webmaster forum - HTTP_POST_FILES PHP file naming clasing with ISP

Author

HTTP_POST_FILES PHP file naming clasing with ISP

Aaron Whiffin

2006-09-24, 6:58 pm

OKay, this was all working,. but my ISP (DataFlame) have decided to "imporve
security" and so it has stopped.

This part of the script uploads images from a form sent using POST, the
images are processed in PHP (script below)

Anyway, the files are saved in a folder /tmp (not my settings) and saved
with a name such as phpMqhO2G

What Dataflame is doing is deleting all files starting with PHP in /tmp
every minute - and so my temporary files get deleted before they are used.
If images are small there is no problem as it happens quickly, but if they
upload 1-2x 1Mb files they are deleted before the upload is complete and so
script fails.

The start of my checkimage() function looks like this:

global $HTTP_POST_FILES;
if(!is_array ($HTTP_POST_FILES[$image])) { //check to see if there
were any files uploaded
return false;
}
$temp =& $HTTP_POST_FILES[$image];
$stamp = preg_replace("/[.\040]/","",microtime()); //get microtime
stamp - preg removes '.' and ' '
// $imagename = $stamp . $temp['name']; //create filename (use
timestamp to make it unique)
$imagename = $stamp; //create filename (use timestamp only incase
name has invalid chars
// check uploaded file
if (!is_uploaded_file ($temp['tmp_name'])) { //check file has been
uploaded
return false;
}

So the name, as far as I can tell, is set in $HTTP_POST_FILES
($temp['tmp_name'])

I need to change this, and it has to be done before the file is saved,
otherwise as soon as the file is saved it could immediately be deleted
(before a local copy is made)

Remember I have no access to server side variables, I'm only a user

How can I change this so the temp files are NOT prefixed with "php" ... or
specify my own local temporary directory ??

One (of many) URLs where this is called is:
http://www.classiccarsforsale.co.uk...car-private.php

Comments appreciated - really confusing me

Thanks

Mark Goodge

2006-09-24, 6:58 pm

On Tue, 19 Sep 2006 11:14:30 +0100, Aaron Whiffin put finger to
keyboard and typed:

>I need to change this, and it has to be done before the file is saved,
>otherwise as soon as the file is saved it could immediately be deleted
>(before a local copy is made)
>
>Remember I have no access to server side variables, I'm only a user
>
>How can I change this so the temp files are NOT prefixed with "php" ... or
>specify my own local temporary directory ??

You can't. The "php" prefix is hardcoded into system (as it is for
anything else which uses /tmp in this way, so that one program can't
pretend to be another), and the location of the tmp directory is set
in php.ini and it's one of the variables that can't be overridden by
the user.

So the only answer is that your host is a numpty and you're stuffed -
you need to move your sites to somewhere with more clue. As an interim
solution, you might be able to set up a site on a cheapo server
elsewhere that acts solely as an image repository and have the script
upload there instead of the main site.

Mark
--
Please help a cat in need: http://www.goodge.co.uk/cat/

Aaron Whiffin

2006-09-24, 6:58 pm

>>I need to change this, and it has to be done before the file is saved,
>
> You can't. The "php" prefix is hardcoded into system (as it is for
> anything else which uses /tmp in this way, so that one program can't
> pretend to be another), and the location of the tmp directory is set
> in php.ini and it's one of the variables that can't be overridden by
> the user.
>
> So the only answer is that your host is a numpty and you're stuffed -
> you need to move your sites to somewhere with more clue. As an interim
> solution, you might be able to set up a site on a cheapo server
> elsewhere that acts solely as an image repository and have the script
> upload there instead of the main site.

That's what I thought - grrrr

A truly crap ISP in every way, we are moving but cannot do until after Xmas
(lots of bus reasons for my client), VERY annoying

Do not use DataFlame - EVER

May consider your temporary server option

Thanks for your help

Charles Sweeney

2006-09-24, 6:58 pm

Aaron Whiffin wrote

> OKay, this was all working,. but my ISP (DataFlame) have decided to
> "imporve security" and so it has stopped.
>
> This part of the script uploads images from a form sent using POST,
> the images are processed in PHP (script below)
>
> Anyway, the files are saved in a folder /tmp (not my settings) and
> saved with a name such as phpMqhO2G
>
> What Dataflame is doing is deleting all files starting with PHP in
> /tmp every minute - and so my temporary files get deleted before they
> are used. If images are small there is no problem as it happens
> quickly, but if they upload 1-2x 1Mb files they are deleted before the
> upload is complete and so script fails.
>
> The start of my checkimage() function looks like this:
>
> global $HTTP_POST_FILES;
> if(!is_array ($HTTP_POST_FILES[$image])) { //check to see if
> there
> were any files uploaded
> return false;
> }
> $temp =& $HTTP_POST_FILES[$image];
> $stamp = preg_replace("/[.\040]/","",microtime()); //get microtime
> stamp - preg removes '.' and ' '
> // $imagename = $stamp . $temp['name']; //create filename (use
> timestamp to make it unique)
> $imagename = $stamp; //create filename (use timestamp only
> incase
> name has invalid chars
> // check uploaded file
> if (!is_uploaded_file ($temp['tmp_name'])) { //check file has been
> uploaded
> return false;
> }
>
> So the name, as far as I can tell, is set in $HTTP_POST_FILES
> ($temp['tmp_name'])
>
> I need to change this, and it has to be done before the file is saved,
> otherwise as soon as the file is saved it could immediately be deleted
> (before a local copy is made)
>
> Remember I have no access to server side variables, I'm only a user
>
> How can I change this so the temp files are NOT prefixed with "php"
> ... or specify my own local temporary directory ??
>
> One (of many) URLs where this is called is:
> http://www.classiccarsforsale.co.uk...ll-classic-car-
private.p
> hp
>
> Comments appreciated - really confusing me

I'm with Mark, your host is bonkers. I suspect they might mean well.
It would be better to delete temporary files over a certain age, rather
than every nth minute.

What would be the harm in deleting (any) temporary files that were over
one day old, say?

--
Charles Sweeney
http://CharlesSweeney.com

Aaron Whiffin

2006-09-24, 6:58 pm

> I'm with Mark, your host is bonkers. I suspect they might mean well.
> It would be better to delete temporary files over a certain age, rather
> than every nth minute.
>
> What would be the harm in deleting (any) temporary files that were over
> one day old, say?

And I'm with you ... dispute still contuing ...

Jerry Stuckle

2006-09-24, 6:58 pm

Charles Sweeney wrote:
> Aaron Whiffin wrote
>
>
>
> private.p
>
>
>
> I'm with Mark, your host is bonkers. I suspect they might mean well.
> It would be better to delete temporary files over a certain age, rather
> than every nth minute.
>
> What would be the harm in deleting (any) temporary files that were over
> one day old, say?
>

Naw, they've probably overloaded the server so much they end up with a
huge number of files in /tmp (due to all the sites uploading). And this
is their lame-brained way of taking care of it.

After all, checking to see how old they were would require at least
three lines of shell script, wouldn't it? This way they can just

rm /tmp/php*

Sooo much easier.

--
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

Toby Inkster

2006-09-24, 6:59 pm

Aaron Whiffin wrote:

> What Dataflame is doing is deleting all files starting with PHP in /tmp
> every minute - and so my temporary files get deleted before they are used.

As someone who maintains several servers running PHP, I can say this
sounds incredibly stupid.

Change hosts.

--
Toby A Inkster BSc (Hons) ARCS
Contact Me ~ http://tobyinkster.co.uk/contact

Aaron Whiffin

2006-09-24, 6:59 pm

>> What Dataflame is doing is deleting all files starting with PHP in /tmp
>
> As someone who maintains several servers running PHP, I can say this
> sounds incredibly stupid.
>
> Change hosts.

We will be doing this shortly ;o)