Upload problem (permission denied)

Question

I'm currently using the file component in the vork framework to upload a file and I keep getting this error:

Warning: move_uploaded_file(/uploads) [function.move-uploaded-file]: failed to open stream: Permission denied in /var/www/rto-vork/mvc/components/file on line 105

Warning: move_uploaded_file() [function.move-uploaded-file]: Unable to move '/tmp/php3WC6QP' to '/uploads' in /var/www/rto-vork/mvc/components/file on line 105 string(32) "Could not move the uploaded file" success

I believe the component itself is fine, and the uploads directory has already been chmoded to 777

here's the code for the upload the file id is being passed in correctly

public function uploadFile($id, $destination, $imagesOnly = false) {

    $return = false;

    if (substr($_FILES[$id]['name'], 0, 1) == '.') {

        $return = 'File names must not begin with a dot';

    } else {

        $isInvalidUpload = $this->isInvalidUpload($id, $imagesOnly);

        if ($isInvalidUpload) {

            $return = $isInvalidUpload;

        } else {

            if (move_uploaded_file($_FILES[$id]['tmp_name'], $destination)) {

                if (is_dir($destination)) {

                    if ($destination[-1] != '/' && $destination[-1] != '\\') {

                        $destination .= '/';

                    }

                    $destination .= $_FILES[$id]['tmp_name'];

                }

                chmod($destination, 0777);

            } else {

                $return = 'Could not move the uploaded file';

            }

        }

    }

    return $return;

}

Finally got it working by combining the two fixes Mar B and Col. Shrapnel gave. Thanks guys :) — Adam McMahon

Marc B Marc B · Accepted Answer · 2010-06-29T17:06:48

Your code's flawed:

public function uploadFile($id, $destination, $imagesOnly = false) {
   ...
   if (move_uploaded_file(...)) {
       if (is_dir(...)) {
           ...
       }
    } else {
       $return = 'Could not move the uploaded file';
    }
}

You call the method with uploadFile('somename', '/uploads'), so the code first tries to move the uploaded file to /uploads directly, but this is a directory. move_uploaded_file() does not act like a regular filesystem 'move' command, the source AND target both have to be filenames. So your initial move attempt fails, it returns false, and things jump directly to the "could not move file" return call. It never even tries to handle $destination being a directory

You should restructure the method as follows:

public function uploadFile(...) {
    ...
    // if $destination is a directory, handle that fact
    if (is_dir($destination)) {
       $destination .= '/' . $new_file_name;
    }
    // THEN try to move the file
    if (move_uploaded_file($source, $destination)) {
       return('worked');
    } else {
       return('failed');
    }
}

Also, be aware that while it's unlikely, the temporary filename that PHP assigns is NOT guaranteed to be unique over time. It's entirely possible that at some point down the line, the same random name will be generated again, and you'll overwrite an older upload. You should be using a filename that is guaranteed to be unique, like a primary key 'id' field from a database or some other source of non-repeating data.

Upload problem (permission denied)

3 Answers