php:: how long to tmp files stay?

Question

I am working on an upload script.

If a user uploads a file and it already exists I want to warn the user (this is all through ajax) and give them the option to replace it, or cancel.

Instead of moving the file, I was curious if I could just leave the file in tmp and pass back the path to that file in the ajax response.

If they user says overwrite the old file in that ajax request pass the path back to php which continues to work on the file.

For this to work however I need to know how long a file stays in php's tmp dir

Jacquard

When I do a file upload tool, I first check if the file is already on the server - if it already exists, I'll rename the new file with a number in front of the file name, depending on how many of them there are. No conflicts, everyone goes home happy. – Misjudge

if you pass the path in tmp back in the ajax response, doesn't that imply someone could mess with the next request and move some other file from somewhere else by replacing that value? (just a thought) – Nette

well sort of, all they could really do is move a file from the tmp directory to the directory you had specified, and the chances of them knowing what is in your tmp directory is a bit unlikely, although a good thought. – Jacquard

Answer 1

Files uploaded through POST are deleted right after php script finishes its execution.

According to php.net: "The file will be deleted from the temporary directory at the end of the request if it has not been moved away or renamed."

Dielu

even files that have been uploaded from a html input? – Jacquard

Doesn't matter where the file came from. Also - each input in browser is html one ;-) – Dielu

really? does php keep track of every file it writes and delete it? i'm pretty sure it doesn't! I have a php script that generates thumbnails on demand for images, and if php deleted files after a script runs, the thumbnails would never exist! – Nette

@John Gardner: php.net/manual/en/features.file-upload.post-method.php "The file will be deleted from the temporary directory at the end of the request if it has not been moved away or renamed." and in my practice I never met the fact that temporary file was not deleted. And you generate new file. Of course they are not being deleted, because they were created by you, and I am (and OP is) talking about temporary files. – Dielu

OP said "If a user uploads a file and it already exists..." so i presumed that the OP was already moving the "php temp" file to somewhere else, like /tmp or $TEMP or whatever. – Nette

@John Gardner: then OP should be precise in his further questions ;-) The only meaning of term temp in such context I can realize is a directory where files are uploaded to. If it is actually "OP was already moving" then there is no correct answer, because of insufficient of information. – Dielu

John, your PHP takes the opens the temp file and rewrites it elsewhere, or copies it out of the temp folder to a new location. – Fluorinate

Probably should have explained better, Basically I was hoping I could just leave the file in the tmp directory (so I have not moved it yet) until I get a response from the user saying if they want to delete the old file from the permanent directory. If I got a response back I would move it. Otherwise php would remove it in due time. However seeing as how php deletes the file straight of the bat, guess ill have to handle that myself :) (better explanation?) – Jacquard

@Dielu very true, but what if I am uploading to php from a C# application input ;) – Jacquard

@Hailwood: it doesn't matter where a file came from ;-) If its uploading was handled by php - then it will be deleted after request processed completely. – Dielu

@zerkms: I know ;) It was in reply to "each input in browser is html one ;-)" – Jacquard

@Hailwood: yep, in browser - it is true ;-) – Dielu

That's only true for files uploaded through the browser. If you generate a file with PHP, then it stays in the tmp directory after the php script finishes its execution. – More

@OMA: no one even doubt it ) – Dielu

Does this file get deleted after the execution finished when renamed within the default /tmp dir ? E.g. when $FILES['tmp_name']=/tmp/abc321.tmp renamed to /tmp/myfile.jpg then waht happens? – Fit

@Fit you could check it yourself. – Dielu

Answer 2

For uploaded files, the manual states:

The file will be deleted from the temporary directory at the end of the request if it has not been moved away or renamed.

Files that are to be kept should therefore be moved to another location.

More generally, as your question title might imply, temporary folders are left to be cleaned up by the system. This is true when using functions like tempnam or tmpfile, or simply when writing to the temporary directory (see sys_get_temp_dir).

In Ubuntu, this is done at every system reboot, or at a time interval, as defined in /etc/default/rcS.

In some Red Hat based distros, it is done using the tmpwatch utility from a cronjob. In others, the /tmp partition is mounted using the tmpfs filesystem, which is similar to a RAM disk (therefore being cleaned when the computer shuts down).

Another known mechanism is a size threshold, which means that the temporary directory will be cleaned up from the older files when it reaches a certain size.

Ruiz

Answer 3

There are three variables that need to be set in PHP to make sure that Garbage Collection of the /tmp directory happens correctly and they are:

session.gc_maxlifetime = 21600
session.gc_probability = 1
session.gc_divisor = 100

Set session.gc_maxlifetime to be the number of seconds you want each tmp file to last before it's deleted. If you login to the admin in OpenCart, this is the number of seconds until you will automatically be logged out. For example to set half an hour, you would do 60 seconds times 30 minutes which would be a value of 1800 seconds.

The other two variables are related to when the Garbage Collector will run, and it's important that they are set to the values above if you're having problems with this.

More info here: https://www.antropy.co.uk/blog/opencart-php-session-tmp-files-filling-up/

Wearisome

This is only true for PHP sessions that are configured to use file storage, and is not relevant to temporary files created by file uploads. – Earthshine