From 58ad1c90b8ff9fa8bb83db5622b7e2d96e04241e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michal=20=C4=8Ciha=C5=99?= <michal@cihar.com>
Date: Wed, 12 Jul 2017 13:42:54 +0200
Subject: [PATCH] Improved handling of uploaded files with open_basedir
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Check whether configured directory is writable as it might be subject to
open_basedir restrictions.

Fixes #13482

Signed-off-by: Michal Čihař <michal@cihar.com>
---
 ChangeLog                       |  1 +
 libraries/File.php              |  4 ++--
 libraries/config/ConfigFile.php | 20 +++++++++++---------
 3 files changed, 14 insertions(+), 11 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 85b97554e6..7c5f9cecce 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -7,6 +7,7 @@ phpMyAdmin - ChangeLog
 - issue #13437 Fixed version check when not connected to a database
 - issue #13465 Fixed creating relation
 - issue #13475 Fixed export without backquotes
+- issue #13482 Improved handling of uploaded files with open_basedir
 
 4.7.2 (2017-06-29)
 - issue #13314 Make theme selection keep current server
diff --git a/libraries/File.php b/libraries/File.php
index 3b7725db6d..79fe0ed90e 100644
--- a/libraries/File.php
+++ b/libraries/File.php
@@ -484,7 +484,7 @@ class File
         }
 
         $tmp_subdir = ConfigFile::getDefaultTempDirectory();
-        if (@is_writable($tmp_subdir)) {
+        if (is_null($tmp_subdir)) {
             // cannot create directory or access, point user to FAQ 1.11
             $this->_error_message = Message::error(__(
                 'Error moving the uploaded file, see [doc@faq1-11]FAQ 1.11[/doc].'
@@ -493,7 +493,7 @@ class File
         }
 
         $new_file_to_upload = tempnam(
-            realpath($tmp_subdir),
+            $tmp_subdir,
             basename($this->getName())
         );
 
diff --git a/libraries/config/ConfigFile.php b/libraries/config/ConfigFile.php
index 30f96146d5..ff0d8d8de5 100644
--- a/libraries/config/ConfigFile.php
+++ b/libraries/config/ConfigFile.php
@@ -535,16 +535,18 @@ class ConfigFile
      */
     public static function getDefaultTempDirectory()
     {
-        $tmp_subdir = null;
-        if (! empty($GLOBALS['cfg']['TempDir']) && @is_writable($GLOBALS['cfg']['TempDir'])) {
-            $tmp_subdir = $GLOBALS['cfg']['TempDir'];
-        } else {
-            $tmp_subdir = ini_get('upload_tmp_dir');
-            if (empty($tmp_subdir)) {
-                $tmp_subdir = sys_get_temp_dir();
+        $dirs = array(
+            $GLOBALS['cfg']['TempDir'],
+            ini_get('upload_tmp_dir'),
+            sys_get_temp_dir(),
+        );
+
+        foreach ($dirs as $dir) {
+            if (! empty($dir) && @is_writable($dir)) {
+                return realpath($dir);
             }
-            $tmp_subdir = rtrim($tmp_subdir, DIRECTORY_SEPARATOR);
         }
-        return $tmp_subdir;
+
+        return null;
     }
 }