View Full Version : Is tmpfile() restricted by open_basedir setting or not?

08-12-2008, 04:41 AM
According to this comment (http://php.net/manual/en/function.tmpfile.php#74623) on the PHP manual pages, the tmpfile() function is affected by the open_basedir setting.

Quoting from the mentioned comment about tmpfile():

Remember, that open_basedir affects this function. You will get an error:

Warning: tmpfile() [function.tmpfile]: open_basedir restriction in effect. File(/var/tmp) is not within the allowed path(s): ....blablabla =)

Ok, I decided to test, so I altered my php.ini adding this restriction:

open_basedir = D:\htdocs

After restarting php, I checked with phpinfo() that the open_basedir was in effect, it was...

Fine, then lets try to run this script which should produce the mentioned warning message since my TEMP directory, "C:\Windows\Temp", (as shown in phpinfo()) is now outside the open_basedir, and I would then not expect tmpfile() to be working.

$temp = tmpfile();
fwrite($temp, "writing to tempfile");
fseek($temp, 0);
echo 'x:'.fread($temp, 1024);

sleep(10); // sleep 10 seconds

(According to the PHP documentation the temporary file created by tmpfile() will automatically be deleted again when the script ends so sleep(10) was added so I could check whether the temporary file was created or not while the script was running.)

Now comes the weird part... Strangely, I get absolutely no warning message when running the above script. On the contrary, tmpfile() seems to be totally unaffected by the open_basedir setting! And when I look in "C:\Windows\Temp" I indeed see the a file phpX.tmp appear and vanish when the script starts and stops. But "C:\Windows\Temp" is not within "D:\htdocs" which I has set as the open_basedir restriction and where the script is running.

My question is therefore: When is tmpfile() restricted by open_basedir, and when not?

Environment: PHP 5.2.6 / Apache / Microsoft Windows Server 2003

If it is of interest, the reason for the above question is that I am trying to figure out why some users are having trouble with the PEAR Spreadsheet_Excel_Writer (http://pear.php.net/package/Spreadsheet_Excel_Writer/redirected) on some hosts.