FS#40643 - [roundcubemail] Symlink of temp folder to /tmp/roundcube causes file attachement/upload fail

Attached to Project: Community Packages
Opened by Witit Sujjapong (bsujja) - Monday, 02 June 2014, 13:26 GMT
Last edited by Sergej Pupykin (sergej) - Thursday, 26 June 2014, 16:58 GMT
Task Type Bug Report
Category Packages
Status Closed
Assigned To Sergej Pupykin (sergej)
Architecture All
Severity Medium
Priority Normal
Reported Version
Due in Version Undecided
Due Date Undecided
Percent Complete 100%
Votes 3
Private No

Details

Description:
The change in 1.0.1-2, symlink of temp folder to /tmp/roundcube causes file attachment/upload fail

Additional info:
* package version(s) 1.0.1-2
* config and/or log files etc.


Steps to reproduce:
After upgraded to 1.0.1-2, cannot attach file to email. File upload failed. Changed back by removing symlink /usr/share/webapps/roundcubemail/temp -> /tmp/roundcube and recreating temp folder, file attachment/upload works again.
This task depends upon

Closed by  Sergej Pupykin (sergej)
Thursday, 26 June 2014, 16:58 GMT
Reason for closing:  Fixed
Comment by Doug Newgard (Scimmia) - Monday, 02 June 2014, 15:20 GMT
Does /tmp/roundcube exist? Have you tried changing permissions on it?
Comment by Witit Sujjapong (bsujja) - Monday, 02 June 2014, 15:43 GMT
Yes /tmp/roundcube exists. I guess it was created/ by the 1.0.1-2 upgrade. I've tried changing permission to 0777 but the problem remains the same. Tried chown http:http both /usr/share/webapps/roundcubemail/temp and /tmp/roundcube and no change. Adding /tmp/roundcube and /var/logs/roundcubemail to open_basedir in php.ini won't help either.

error log:
[02-Jun-2014 17:51:14 Asia/Bangkok] PHP Warning: tempnam(): open_basedir restriction in effect. File() is not within the allowed path(s): (/srv/http/:/srv/http/www/:/home/:/tmp/:/var/log/roundcubemail/:/usr/share/pear/:/usr/share/webapps/:/usr/share/misc/magic/:/etc/webapps/:/etc/nginx/) in /usr/share/webapps/roundcubemail/plugins/filesystem_attachments/filesystem_attachments.php on line 57
[02-Jun-2014 17:51:14 Asia/Bangkok] PHP Warning: move_uploaded_file(): open_basedir restriction in effect. File() is not within the allowed path(s): (/srv/http/:/srv/http/www/:/home/:/tmp/:/var/log/roundcubemail/:/usr/share/pear/:/usr/share/webapps/:/usr/share/misc/magic/:/etc/webapps/:/etc/nginx/) in /usr/share/webapps/roundcubemail/plugins/filesystem_attachments/filesystem_attachments.php on line 59
Comment by Ondřej G. (nemamradfazole) - Sunday, 22 June 2014, 07:28 GMT
This bug sucks!!

Thanks Witit for the solution!

It's strange that those logs contain "File()" with no file contained in the parenthesis, same happened to me, and just by recreating the /usr/share/webapps/roundcubemail/temp folder the error disappears. (Well, I also chowned it to be sure.)
Comment by Witit Sujjapong (bsujja) - Wednesday, 25 June 2014, 16:45 GMT
It seems that the symlink is interpreted as a relative reference so roundcube is looking for "/usr/share/webapps/roundcubemail/tmp/roundcube/" which doesn't exist thus "File()" in the log. Strangely enough another symlink /usr/share/webapps/roundcubemail/logs -> /var/log/roundcubemail/ works correctly.
Comment by Sergej Pupykin (sergej) - Wednesday, 25 June 2014, 17:07 GMT
please try roundcubemail-1.0.1-3. I've removed logs and temp symlinks changing default values in roundcubemail sources.
Comment by arielp (ajp) - Wednesday, 25 June 2014, 22:16 GMT
When upgrading from 1.0.1-2 to -3 I get.

[ALPM-SCRIPTLET] chown: cannot access ‘var/log/roundcubemail’: No such file or directory
Comment by Witit Sujjapong (bsujja) - Thursday, 26 June 2014, 03:02 GMT
I've tried the new 1.0.1-3. After trying different temp_dir configs, I can conclude that only the "/tmp" folder/sub-folder won't work. For testing I changed temp_dir to "/var/log/roundcubemail" and it worked. Of course the relative path "temp/" continues to work if the folder "/usr/share/webapps/roundcubemail/temp" exists.
Comment by Sergej Pupykin (sergej) - Thursday, 26 June 2014, 10:59 GMT
1.0.1-5 should work. I've moved /tmp/roundcubemail to /var/cache/roundcubemail
don't forget to update apache config
Comment by Witit Sujjapong (bsujja) - Thursday, 26 June 2014, 16:30 GMT
Confirm 1.0.1-5 working now after adding /var/cache/roundcubemail to open_basedir in php.ini in my case.

Loading...