diff --git includes/file.inc includes/file.inc index 4f7a4c3..77d010a 100644 --- includes/file.inc +++ includes/file.inc @@ -1525,7 +1525,7 @@ function file_save_upload($source, $validators = array(), $destination = FALSE, // directory. This overcomes open_basedir restrictions for future file // operations. $file->uri = $file->destination; - if (!move_uploaded_file($_FILES['files']['tmp_name'][$source], $file->uri)) { + if (!drupal_move_uploaded_file($_FILES['files']['tmp_name'][$source], $file->uri)) { form_set_error($source, t('File upload error. Could not move uploaded file.')); watchdog('file', 'Upload error. Could not move uploaded file %file to destination %destination.', array('%file' => $file->filename, '%destination' => $file->uri)); return FALSE; @@ -2320,6 +2320,40 @@ function drupal_tempnam($directory, $prefix) { } /** + * Moves an uploaded file to a new location. + * + * PHP's move_uploaded_file() does not properly support streams if safe_mode + * is enabled, so this function fills that gap. + * + * @see http://php.net/move_uploaded_file + * + * Compatibility: normal paths and stream wrappers. + * @see http://drupal.org/node/515192 + * + * @param $filename + * The filename of the uploaded file. + * @param $uri + * A string containing the destination URI of the file. If this value is + * omitted, Drupal's public files directory will be used [public://]. + * + * @return + * TRUE on success, or FALSE on failure. + * + * @see move_uploaded_file() + * @ingroup php_wrappers + */ +function drupal_move_uploaded_file($filename, $uri) { + // If PHP is running under safe_mode, convert the file destination to its + // real path, if possible, to avoid failing the security check in + // move_uploaded_file(). + if (!ini_get('safe_mode') || !($destination = drupal_realpath($uri))) { + $destination = $uri; + } + + return move_uploaded_file($filename, $destination); +} + +/** * Get the path of system-appropriate temporary directory. */ function file_directory_temp() {