Topic: php file uploads a sort of how to

[chrislaurie]

Thought I'd share my results after a day of trying to get the excellent bug tracking app Mantis to do php file uploads.

I installed Mantis into /opt/mantis and created my own custom template for httpd.conf.

To get Mantis to work with file uploads you must add the following line to your template directory part:

php_admin_value upload_tmp_dir /opt/mantis/uploads

You must also create the /opt/mantis/uploads dir with the appropriate owner and permissions. www.www 770 worked for me.

This assumes you have this entry in there as well:

php_admin_value open_basedir /opt/mantis

Thanx to Charly Brady for pointing me in the right dorection. He made the following comment on the forum (not verbatim): "php uploads work fine (otherwise webmail would not be able to handle attachments) as long as you operate within open_basedir."

YMMV and I'm not to blame if this screws up your system. I suspect this approach would work for other php apps that need to do file uploads.

Cheers

Chris Laurie

PS For those that are interested here is the contents of my custom template fragment:

/etc/e-smith/templates_custom/etc/httpd/conf/httpd.conf/95mantis

Alias  /mantis  /opt/mantis

<Directory /opt/mantis>
    AddType application/x-httpd-php .php .php3 .phtml
    SSLRequireSSL
    php_admin_value open_basedir /opt/mantis
    php_admin_value upload_tmp_dir /opt/mantis/uploads
    php_admin_value eaccelerator.enable 1
    Options None
    AllowOverride All
    order deny,allow
    deny from all
    allow from all
</Directory>

I'm not clued up about what all the entries mean, but it works for me!

[jfarschman]

Chris,

  Thanks... that was well explained.

  I'm sort of torn between the concept of installing an application in /opt/something or in an ibay.  I've seen it done both ways.  Any reason why you didn't chose to control things in an ibay?  It may have made the permissions step a little easier.

[chrislaurie]

I have seen several people make this suggestion - maybe one of the developers can chime in and give a proper explanation.

An ibay has lots of things in it and it can be exposed - to Samba for instance. I understand that you are safer in /opt because with openbasedir your risk area is reduced to the directory you set as openbasedir and below.

An ibay creates a structure that I do not need (.Appledesktop, cgi-bin, files, & html) and then sets access and php parameters on it according to its own rules and I have no influence over that. In /opt I can add whatever directives I need to the httpd config and I have an easy path: try /opt/mantis vs /home/e-smith/files/ibays/mantis/html - when I need to enter a server path in the app (like a download location for instance).

[jfarschman]

Chris,

  That makes sense.   I believe you've done things the correct way.  That's the same way phpMyAdmin is installed.... but egroupware is installed in an ibay.

  Functionally I doubt it matters any.

  Anybody have a strong opinion?