Can't upload -- open_basedir error

I've tried and tried and now I'm just stuck.

I have a completely clean install. It won't upload attachments or pictures. Yes, the directories exist and are world writeable, when you run the check in the admin menu through config.inc.php it says it is correct. When you try to upload though, nothing gets uploaded. Looking at the php error log it says:

----------
[27-Jun-2002 00:06:41] PHP Warning: open_basedir restriction in effect. File is in wrong directory in /big/dom/xfishingfordeals/www/forums2/changebasic.php on line 121
[27-Jun-2002 00:06:41] PHP Warning: getimagesize: Unable to open '/tmp/phpS5ynMf' for reading. in /big/dom/xfishingfordeals/www/forums2/changebasic.php on line 121
[27-Jun-2002 00:06:41] PHP Warning: open_basedir restriction in effect. File is in wrong directory in /big/dom/xfishingfordeals/www/forums2/changebasic.php on line 139
----------

So I figured it was something FutureQuest (host) would have to change. I wrote them and got this explanation:

[]"That script is generating a lot of errors in your logs_cgi/phperror log, which is highly suspect in itself...

It is true that we run with 'open_basedir' for security reasons, however it appears that the failing program makes provisions for handling the 'open_basedir' environment...

If you look at the output of 'phpinfo()', you will find the 'open_basedir' is set to:
/big/dom/xfishingfordeals:/var/shadowdom/xfishingfordeals/logs_web:/usr/local/lib/php:/PHP4:/big/tmp:/big/dom/tmp

The 'read_dump.php' script is failing on line 252 because it is trying to access a file in '/tmp'... Unfortunately this is not allowed because all sites on the server operate as the same user level of 'apache'... If you wrote temporary files to '/tmp', then others could look at your files for which might contain sensitive data like credit card numbers for orders...

If you look at line 239 of that file, you will see it mentions reading the documentation on how to use the './tmp' directory instead to work around this problem...

The true 'tmp' directory for everyone to use with file uploads is not '/tmp' but rather '/big/dom/tmp', and this is how PHP is configured noted by the above string...

At this junction, you will need to keep working with the script as I am 100% confident that PHP file uploads is working properly for a large number of domains across different servers...

Hope this helps to clarify and expand upon the issue you are seeing...

Well, unfortunately it doesn't clarify anything.

So I opened a support ticket at Infopop. Infopop's response was "When I test an attachment it goes up - but I get a 404 when I try to access it." It doesn't "go up" -- that's the problem! It never sucks the file from your computer to the server. That's why you get a 404 error, because the file ISN'T THERE!

If I want them to check it further it will cost $75.

Between this problem and the email problem (new members don't get an email with their password), I haven't been able to switch our board over. I'm getting pressure to switch to VBulletin, and that just stinks, because I really like ubb.threads.

Does anyone have any suggestions on how to fix this so that the uploads actually upload, short of paying $75 for help with a product that should work already? (PLEASE don't misunderstand me -- I'm not one of those people who complains that this is too buggy, etc., because I don't think that. I'm just frustrated that Infopop wants us to pay extra to get something to work that should already work!) I know it works for most people, because I tested it on my own personal website (different host) and the uploads worked fine. But according to FutureQuest the difference is that they have the cgi-bin above the html tree, so PHP can't access it. Is that extremely unusual? Shouldn't there just be directions on how to get around this if your host is set up this way?

Thank you for any help or suggestions anyone can offer.

It's a server setting, we ran across it on another site, tho right now my brain is blank on what we did

Someone mentioned to me yesterday that I could get around this problem by adding something to our .htaccess file. They, nor do I, have any clue what to add though.

I do appreciate the help. Sorry if I sounded frazzled. Five kids will do that to you.

open_base_dir is a PHP configuration directive which limits PHP scripts to only reading/writing files in a specified directory (and its subdirectories). Some of the configuration directives can be used in an .htaccess file, but according to the PHP manual, open_base_dir is one of those that can only be set in php.ini.

I can't tell enough about your configuration from what you've posted.

I would first confirm what they've said by creating a script, e.g., phpinfo.php, consisting of the single line

code:
<?php phpinfo(); ?>

and running that script from a browser. After you've saved the output, delete that script. Then compare the value of open_base_dir with what they told you. Keep the phpinfo.php output handy, since it may contain other info that will be helpful in resolving this.

I don't know that they mean by read_dump.php. I didn't see that file in the UBB.threads directory.

Sorry if you already know this stuff.

I'll take a look and see if there's a way of telling threads which tmp directory to use.

thanks dave, for the info and help

Also check the value of upload_tmp_dir in the phpinfo output. I would think it should be set to the same directory they mentioned above, but if it isn't, that might be the problem. upload_tmp_dir is another directive which can only be used in php.ini.

I found this in the PHP manual (Chapter 19. Handling file uploads):

Files will by default be stored in the server's default temporary directory, unless another location has been given with the upload_tmp_dir directive in php.ini. The server's default directory can be changed by setting the environment variable TMPDIR in the environment in which PHP runs. Setting it using putenv() from within a PHP script will not work. This environment variable can also be used to make sure that other operations are working on uploaded files, as well.

I wonder if TMPDIR could be changed in an .htaccess file.

YEAH!!!!!!!!!!!!

I got it to work!!!

I had to replace

addpost.php

code:

// --------------------------------------------------
// If we have a file attachment then we handle it here
   if ( ($HTTP_POST_FILES['userfile']['name'] != "none") && ($HTTP_POST_FILES['userfile']['name']) ){


      $FileName = "$Mnumber-{$HTTP_POST_FILES['userfile']['name']}";
      copy($HTTP_POST_FILES['userfile']['tmp_name'], "{$config['files']}/$FileName");
-----------------------------------------------------

with this:

code:
// --------------------------------------------------
// If we have a file attachment then we handle it here
   if ( ($HTTP_POST_FILES['userfile']['name'] != "none") && ($HTTP_POST_FILES['userfile']['name']) ){


      $FileName = "$Mnumber-{$HTTP_POST_FILES['userfile']['name']}";
      move_uploaded_file($HTTP_POST_FILES['userfile']['tmp_name'], "{$config['files']}/$FileName");
-----------------------------------------------------

and in

changebasic.php

code:
//-----------------------------------------------------
 // Grab the filetype
      $piece['0'] = "";
      preg_match("/(\.gif|\.png|\.jpg)$/i",$HTTP_POST_FILES['userfile']['name'],$piece);
      $type = $piece['1'];
      $Picturefile = "{$user['U_Number']}$type";
      if ( ($HTTP_POST_FILES['userfile']['tmp_name'] != "none") && ($HTTP_POST_FILES['userfile']['tmp_name']) ){
         copy($HTTP_POST_FILES['userfile']['tmp_name'], "{$config['avatars']}/$Picturefile");
      }
      $Picture = "{$config['avatarurl']}/$Picturefile";
   }
-----------------------------------------------------

with 

code:
//-----------------------------------------------------
 // Grab the filetype
      $piece['0'] = "";
      preg_match("/(\.gif|\.png|\.jpg)$/i",$HTTP_POST_FILES['userfile']['name'],$piece);
      $type = $piece['1'];
      $Picturefile = "{$user['U_Number']}$type";
      if ( ($HTTP_POST_FILES['userfile']['tmp_name'] != "none") && ($HTTP_POST_FILES['userfile']['tmp_name']) ){
         move_uploaded_file($HTTP_POST_FILES['userfile']['tmp_name'], "{$config['avatars']}/$Picturefile");
      }
      $Picture = "{$config['avatarurl']}/$Picturefile";
   }
-----------------------------------------------------



After all the frettin' I've done over this, I can't believe it all came down to changing "copy" to "move_uploaded_file".  

Allen and Dave, thank you both very much for your help.

nice work lisa, we may need to keep this somewhere as the way to fix that, I know it comes up occasionally

That's interesting.

Is PHP safe_mode is enabled on that server?

Yes, safe_mode is on.

humm ok I have this same problem but only with a couple modators
everyone else uploads there pictures with no problem

ok I had the same 2 peopple that had trouble uploading there picture & had them make a temp account LOl they are able to upload there pictures with no problem

so that brings me back to is it a mod code problem or a cookie problem
strange problem

Couldn't be a cookie.

You're replying to an eight-month-old post.

It was only on Page 2! This isn't nearly as busy as I'd think.

Maybe I should lurk some more. :lurks:

Official support and Bug Reports are now done at infopop community. This site is for code modifications.