上传的PHP临时文件名称冲突 [英] PHP temp file names for uploads colliding

问题描述

当一个用户上传一个文件时，它随机被另一个用户上传替换，我终于把问题追踪到了PHP，并且tmp文件名被重用了。有没有办法来解决这个问题？有没有办法做出更好的随机名称？随着时间的推移，似乎会随着随机文件名种子变弱而降低？这是在PHP 5.2.8和FreeBSD 7.0上的。

下面是一个日志，显示了如何使用相同的tmp文件名，并被另一个上传覆盖： http://pastebin.com/m65790440

任何帮助都非常赞赏。我一直试图解决这个问题超过4个月，随着时间的推移变得越来越糟。谢谢。编辑：请记住，这不是一个PHP代码问题，这是在它到达任何PHP代码之前，通过$ _FILES [''名称'] ['tmp_name']在接收到时被错误地认为是由别人的上传覆盖，然后到达上传处理脚本

解决方案

听起来像是你的PHP安装或PHP在内部使用来产生随机文件名的任何系统调用都是严重错误的（最可能是

对于其他人：上传的PHP句柄在用户代码被处理之前在内部文件。这些名称存储在 $ _ FILES ['file'] ['tmp_name'] （其中'file'是表单中文件输入元素的（引号）名称） 。

When a user uploads a file, randomly it gets replaced by another user's upload, I've finally tracked down the issue to PHP and the tmp file name being reused. Is there a way to fix this? Is there a way to make better random names? It seems to degrade over time, as in the random file name seed gets weaker? This is on PHP 5.2.8 and FreeBSD 7.0

Here is a log showing how the same tmp file name gets used and is overwritten by another upload: http://pastebin.com/m65790440

Any help is GREATLY appreciated. I've been trying to fix this for over 4 months and has gotten worse over time. Thank you.

EDIT: Keep in mind that this is not a PHP code issue, this is happening before it reaches any PHP code, the file received via $_FILES['name']['tmp_name'] is incorrect when it is received and its been traced back that it is being overwritten with someone else's upload before it reaches the upload processing script

解决方案

It sounds like something is seriously wrong with either your PHP installation or whichever system call PHP is internally using to generate the random file names (most likely tempnam).

For everyone else: PHP handles uploaded files internally before the user code is ever processed. These names are stored in $_FILES['file']['tmp_name'] (where 'file' is the (quoted) name of the file input element on the form).

这篇关于上传的PHP临时文件名称冲突的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！