Fix: Prevent dumping files into /tmp of the server

[andrew...@gmail.com]

On a virtual server, the command sys_get_temp_dir was pulling /tmp of the main server and then dumping the zip files for the batch download there.  Therefore, the edits were made so it would use the upload_tmp_dir which was specified in the php.ini file.  You must specify the directory in the php.ini file for this to work - letting it default to a directory did not work.

The following edits were made to the code to prevent the [sys_get_temp_dir] from pulling up the shared /tmp directory for the shared host.  This had caused problems when people were downloading zipped files which were being left in the shared partition.  A variant of the line below was subbed in.)
SUB: ini_get("upload_tmp_dir").DIRECTORY_SEPARATOR.$name.'zip';



 542 - FilesystemController.class.php: 
		public function getUploadTempDir() {
			$dir = $this->env->settings()->setting("upload_temp_dir");
			if ($dir != NULL and strlen($dir) > 0) return $dir;
			return ini_get("upload_tmp_dir");
			/*return sys_get_temp_dir();to prevent leaking files onto shared hosting tmp folder */
		}

26 - MollifyZipArchive.class.php
function __construct($env, $name = FALSE) {		

			if (!class_exists('ZipArchive'))
				throw new ServiceException("INVALID_CONFIGURATION", "ZipArchive lib not installed");
				
			$this->env = $env;
			$this->name = $name ? $name : uniqid('Mollify', true);
			$this->path = ini_get("upload_tmp_dir").DIRECTORY_SEPARATOR.$name.'zip';
			/*$this->path = sys_get_temp_dir().DIRECTORY_SEPARATOR.$name.'zip';to prevent leaking files onto shared hosting tmp folder */
			$this->zip = new ZipArchive();
			if ($this->zip->open($this->path, ZIPARCHIVE::CREATE) !== TRUE)
				throw new ServiceException("REQUEST_FAILED", "Could not create zip ".$this->path);
		}
80 - MollifyZipNative.class.php
		function __construct($env, $name = FALSE) {
			$this->env = $env;
			$this->name = $name ? $name : uniqid('Mollify', true);
			this->path = ini_get("upload_tmp_dir").DIRECTORY_SEPARATOR.$name.'zip';
			/*$this->path = sys_get_temp_dir().DIRECTORY_SEPARATOR.$name.'zip';to prevent leaking files onto shared hosting tmp folder */
			$this->cmd = self::command('application/zip');
			if ($this->cmd == NULL) throw new ServiceException("INVALID_CONFIGURATION", "No native zip library found");
		}
23 - MollifyZipRaw.class.php
		function __construct($env, $name = FALSE) {
			$this->env = $env;
			$this->name = $name ? $name : uniqid('Mollify', true);
			$this->path = ini_get("upload_tmp_dir").DIRECTORY_SEPARATOR.$name.'zip';
			/*$this->path = sys_get_temp_dir().DIRECTORY_SEPARATOR.$name.'zip';to prevent leaking files onto shared hosting tmp folder */
			$this->zip = new zipfile();
		}
56 - ItemCollectinHandler.class.php
				//$mobile = ($this->env->request()->hasParam("m") and strcmp($this->env->request()->param("m"), "1") == 0);
				$id = urldecode($this->env->request()->param("id"));
				$file = ini_get("upload_tmp_dir").DIRECTORY_SEPARATOR.$id.'zip';
				/*$file = sys_get_temp_dir().DIRECTORY_SEPARATOR.$id.'zip';to prevent leaking files onto shared hosting tmp folder */
				if (!file_exists($file)) {
					Logging::logDebug("Zip file missing ".$file);
					die();
33 - UrlRetriever.class.php
			$tempFile = ini_get("upload_tmp_dir").DIRECTORY_SEPARATOR.uniqid('Mollify', true);
			/*$tempFile = sys_get_temp_dir().DIRECTORY_SEPARATOR.uniqid('Mollify', true);to prevent leaking files onto shared hosting tmp folder */
			$fh = @fopen($tempFile, "wb");
			if (!$fh) {
				curl_close($h);
				throw new ServiceException("INVALID_CONFIGURATION", "Could not open temporary file for writing: ".$tempFile);
			}

[Samuli Järvelä]

You are right, didn't think of this scenario. Maybe I should even make this a setting where the default value would be the "upload_tmp_dir" but could be changed in config. It would be consistent in every place, and changing would not require touching the source files.

--
You received this message because you are subscribed to the Google Groups "Mollify" group.
To unsubscribe from this group and stop receiving emails from it, send an email to mollified+...@googlegroups.com.
To post to this group, send email to moll...@googlegroups.com.
Visit this group at http://groups.google.com/group/mollified?hl=en.
For more options, visit https://groups.google.com/groups/opt_out.