Upload problem (permission denied)

Question

I'm currently using the file component in the vork framework to upload a file and I keep getting this error:

Warning: move_uploaded_file(/uploads) [function.move-uploaded-file]: failed to open stream: Permission denied in /var/www/rto-vork/mvc/components/file on line 105

Warning: move_uploaded_file() [function.move-uploaded-file]: Unable to move '/tmp/php3WC6QP' to '/uploads' in /var/www/rto-vork/mvc/components/file on line 105 string(32) "Could not move the uploaded file" success

I believe the component itself is fine, and the uploads directory has already been chmoded to 777

here's the code for the upload the file id is being passed in correctly

public function uploadFile($id, $destination, $imagesOnly = false) {

    $return = false;

    if (substr($_FILES[$id]['name'], 0, 1) == '.') {

        $return = 'File names must not begin with a dot';

    } else {

        $isInvalidUpload = $this->isInvalidUpload($id, $imagesOnly);

        if ($isInvalidUpload) {

            $return = $isInvalidUpload;

        } else {

            if (move_uploaded_file($_FILES[$id]['tmp_name'], $destination)) {

                if (is_dir($destination)) {

                    if ($destination[-1] != '/' && $destination[-1] != '\\') {

                        $destination .= '/';

                    }

                    $destination .= $_FILES[$id]['tmp_name'];

                }

                chmod($destination, 0777);

            } else {

                $return = 'Could not move the uploaded file';

            }

        }

    }

    return $return;

}

Answer 1

Looks to me like you are trying to move either the directory itself or you are trying to write a directory instead of a file.

Warning: move_uploaded_file**(/uploads)** [function.move-uploaded-file]: failed to open stream: Permission denied in /var/www/rto-vork/mvc/components/file on line 105

Verify you are using the temporary file name generated and that you are specifing a file name to save the file as.

Answer 2

The error message is pretty clear: you cannot write into directory /uploads.
No wonder - on a unix systems nobody let you to write into system root :)
That's your problem - you have messed up a web root and a filesystem root.
in general, this code should help, if the rest code is fine:

$destination = $_SERVER['DOCUMENT_ROOT'].$destination;

but I doubt the rest code is fine
say, $destination .= $_FILES[$id]['tmp_name']; is pretty senseless code.
I think you'd better find yourself another component or write your own

Answer 3

Your code's flawed:

public function uploadFile($id, $destination, $imagesOnly = false) {
   ...
   if (move_uploaded_file(...)) {
       if (is_dir(...)) {
           ...
       }
    } else {
       $return = 'Could not move the uploaded file';
    }
}

You call the method with uploadFile('somename', '/uploads'), so the code first tries to move the uploaded file to /uploads directly, but this is a directory. move_uploaded_file() does not act like a regular filesystem 'move' command, the source AND target both have to be filenames. So your initial move attempt fails, it returns false, and things jump directly to the "could not move file" return call. It never even tries to handle $destination being a directory

You should restructure the method as follows:

public function uploadFile(...) {
    ...
    // if $destination is a directory, handle that fact
    if (is_dir($destination)) {
       $destination .= '/' . $new_file_name;
    }
    // THEN try to move the file
    if (move_uploaded_file($source, $destination)) {
       return('worked');
    } else {
       return('failed');
    }
}

Also, be aware that while it's unlikely, the temporary filename that PHP assigns is NOT guaranteed to be unique over time. It's entirely possible that at some point down the line, the same random name will be generated again, and you'll overwrite an older upload. You should be using a filename that is guaranteed to be unique, like a primary key 'id' field from a database or some other source of non-repeating data.