[cobalt-users] Problems with PHP and upload

[Marco Baurdoux <linux@xxxxxxxxxxxxx>]

Hi there you all,

Remember my posting about the erroneous settings files had after an PHP
upload handle ??



-rw-------   1 httpd    root           66 Sep 13 15:47
/home/sites/home/web/tmp/test.file


Well here's the cause, explanation and solution.

INSTALLATION DESCRIPTIONS :
* Raq3, with all the patches applied
* php4.0.4pl1 compiled manually ( ./configure --with-mysql --with-gd etc.. )
* Diverse versions of webalizer


CAUSE:
After installing  RaQ3-All-Security-4.0.4-8762.pkg I noticed that the file
setting in the /tmp changed. So I had a closer look at the what this package
actually did. One of the things it did was create the /home/tmp directory.
In addition to this it replaced all the existing "tmp" folders by symbolic
links that linked to the /home/tmp. Now the fact that the /tmp was moved
caused a change in the uploaded file settings.



EXPLANATION:
A quite simpel one:
Apache doesn't follow symbolic links properly!!!
Therefore the fact of changing the /tmp into a symbolic link, makes him mess
up the file settings.


SOLUTION:

edit the /etc/rc.d/init.d/tmpinit file are comment out the following lines :

# Symlink the three tmp dirs:
if [ -d /tmp ]; then
   rm -rf /tmp
   ln -s /home/tmp /tmp
fi

and then edit the following command.
rm /tmp;mkdir /tmp;ls -l /

by editing this like that the active sessions on your machine will still be
lost, but it won't interupt your services too long.



CONCLUSION:

First I submitted this case to cobalt.
But although they were extremely friendly, all they could answer me was,
that because I compiled PHP myself, I affected my warranty, although it was
more then obvious that the problem came from one of their patches.

So for Cobalt Information, I'm almost 100% sure that this will affect all
people using php. no matter whether they compiled it themselves or whether
they installed your 4.0.6 package. so you might want to take another look at
this one.

So now the new file settings after uploading files are

-rwxr-xr-x   1 httpd    home           66 Sep 13 15:33
         /home/sites/home/web/tmp/test.file


This is still not 100% perfect since group members still cannot modify the
file, but that is another story ( A long story about OS-update-3.0 :-)) )


=======================================================================

Marco Baurdoux
Unix Administrator
Infomaniak Network SA
Avenue de la Praille 26
1227 Carouge
Switzerland
Tel: +41 (0)22 820 35 41
Fax: +41 (0)22 820 35 46
http://web.infomaniak.ch

Linux/Unix is very user friendly,
it's just very picky about who its friends are !!!

=======================================================================