Hi,

my site log is flooded with "The directory sites/default is not writable" message. I placed dpm('<pre>'. print_r(debug_backtrace(), 1) .'</pre>'); inside the function file_check_directory in the file.inc at line 121 and got this output at my frontpage:

 [0] => Array
        (
            [file] => /www/cgfplus_cz/public_html/sites/all/modules/image_resize_filter/image_resize_filter.module
            [line] => 418
            [function] => file_check_directory
            [args] => Array
                (
                    [0] => sites/default
                    [1] => 1
                )

        )

    [1] => Array
        (
            [file] => /www/cgfplus_cz/public_html/sites/all/modules/image_resize_filter/image_resize_filter.module
            [line] => 39
            [function] => image_resize_filter_process
            [args] => Array
                (
                    [0] => Array
                        (
                            [0] => Array
                                (
                                    [expected_size] => Array
                                        (
                                            [width] => 150
                                            [height] => 100
                                        )

                                    [actual_size] => Array
                                        (
                                            [width] => 1000
                                            [height] => 665
                                        )

                                    [add_properties] => Array
                                        (
                                            [width] => 
                                            [height] => 
                                        )

                                    [original] => /sites/default/files/content_images/miska_chlorella.JPG
                                    [location] => local
                                    [local_path] => sites/default/files/content_images/miska_chlorella.JPG
                                    [mime] => image/jpeg
                                    [extension] => jpg
                                )

... etc

I look in the imagefilter code and the problem is that drupal built-in function file_check_directory checks both that directory exists AND is writable (I'm not using Filefield CCK on this site). In the image_resize_filter module is that code:

   foreach ($folders as $folder) {
      $current_directory .= $folder .'/';
      $check_directory = $current_directory;
      // Use the "quiet" version of file_check_directory() provided by FileField
      // if it exists. This suppresses "Directory was created" messages.
      $file_check_directory = function_exists('field_file_check_directory') ? 'field_file_check_directory' : 'file_check_directory';
      $file_check_directory($check_directory, FILE_CREATE_DIRECTORY);
    }

So it seems that each folder in the whole path is checked to be writable - am I right? But keeping sites/default writable is a security hole, I have writable only /sites/default/temp and /sites/default/files. I think that code in this loop has to be changed to check only if the folder exists and check only the last one to be writable. Alternative approach to start "direcory checking loop" with the files directory, not with sites/ directory.

Comments

quicksketch’s picture

Thanks for the extensive description. This problem also affects sites that have PHP's "Safe Mode" enabled. The best solution is what you've suggested, start the directory checking in the files directory and not the entire path. It still needs to be recursive though, because otherwise multiple nested directories won't be created if necessary.

quicksketch’s picture

Status: Active » Needs review
StatusFileSize
new2.6 KB

This patch should fix the problem, though I haven't had a chance to test it at all (my sandbox site is currently preoccupied with some other testing), if you can try this out and let me know if it works I'd appreciate it.

quicksketch’s picture

Please try this one instead, that last one was missing a trailing "/" in the file paths.

wojtha’s picture

Status: Needs review » Reviewed & tested by the community

I've tested the patch and seems working, no new "The directory sites/default is not writable" message appears in watchdog. For now I've tested image reading only, not creating of the new resized image and possibly new directory. Thx for ultimately quick response! :-)

quicksketch’s picture

Status: Reviewed & tested by the community » Fixed

Great, I gave it another testing with private/public files and multiple directory creation, seems to work just fine. Thanks for the testing and report. Committed to CVS.

quicksketch’s picture

I've released version 1.4 that contains this fix.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.