Improved handling of uploaded files with open_basedir

Check whether configured directory is writable as it might be subject to
open_basedir restrictions.

Fixes #13482

Signed-off-by: Michal Čihař <michal@cihar.com>

ChangeLog

@@ -7,6 +7,7 @@ phpMyAdmin - ChangeLog
 - issue #13437 Fixed version check when not connected to a database
 - issue #13465 Fixed creating relation
 - issue #13475 Fixed export without backquotes
+- issue #13482 Improved handling of uploaded files with open_basedir
 
 4.7.2 (2017-06-29)
 - issue #13314 Make theme selection keep current server

libraries/File.php

@@ -484,7 +484,7 @@ class File
         }
 
         $tmp_subdir = ConfigFile::getDefaultTempDirectory();
-        if (@is_writable($tmp_subdir)) {
+        if (is_null($tmp_subdir)) {
             // cannot create directory or access, point user to FAQ 1.11
             $this->_error_message = Message::error(__(
                 'Error moving the uploaded file, see [doc@faq1-11]FAQ 1.11[/doc].'
@@ -493,7 +493,7 @@ class File
         }
 
         $new_file_to_upload = tempnam(
-            realpath($tmp_subdir),
+            $tmp_subdir,
             basename($this->getName())
         );
 

libraries/config/ConfigFile.php

@@ -535,16 +535,18 @@ class ConfigFile
      */
     public static function getDefaultTempDirectory()
     {
-        $tmp_subdir = null;
-        if (! empty($GLOBALS['cfg']['TempDir']) && @is_writable($GLOBALS['cfg']['TempDir'])) {
-            $tmp_subdir = $GLOBALS['cfg']['TempDir'];
-        } else {
-            $tmp_subdir = ini_get('upload_tmp_dir');
-            if (empty($tmp_subdir)) {
-                $tmp_subdir = sys_get_temp_dir();
+        $dirs = array(
+            $GLOBALS['cfg']['TempDir'],
+            ini_get('upload_tmp_dir'),
+            sys_get_temp_dir(),
+        );
+
+        foreach ($dirs as $dir) {
+            if (! empty($dir) && @is_writable($dir)) {
+                return realpath($dir);
             }
-            $tmp_subdir = rtrim($tmp_subdir, DIRECTORY_SEPARATOR);
         }
-        return $tmp_subdir;
+
+        return null;
     }
 }