PHP upload progress indicator and tmp_name

[Ron]

I spent the last couple of days setting up a progress indicator for a
private site that only does a couple uploads a day. After figuring out
there was no way to set the 'upload_tmp_dir' or 'tmp_name' per
session, I resigned to just doing an opendir() and finding the one
file in 'upload_tmp_dir' since I knew there would never be an issue
with multiple uploads occuring at the same time.

if(is_dir($dir)) {
if ($dh = opendir($dir)) {
while (($file = readdir($dh))) {
if(eregi("php", $file)){
$fp = fopen("$dir$file", "r");
$fstat = fstat($fp);
echo "Bytes uploaded: " . $fstat[7] . "<br>\n";
fclose($fp);
closedir($dh);
$done = 0;
}
}
}
}

This works ok and I just do a JS popup with a meta refresh to show how
many bytes have been uploaded so far. I'm not concerned with knowing
the actual filesize, only showing that the upload is working and how
fast it's working, as you can see in the code above.

After all this, the question came to mind as to why it would be
difficult or a security problem to prepend or append something like a
timestamp or sid to the tmp_name so that one could reliably figure out
which tmp file they needed to stat? As would be the case with multiple
uploads. I've looked through the PHP source, specifically
php_open_temporary_file.c and don't see what the problem would be, but
then I'm not an expert at C or PHP.

Thanks for any enlightment here.
Ron

[R. Rajesh Jeba Anbiah]

ro**@linuxdude.com (Ron) wrote in message news:<42**************************@posting.google. com>...

I spent the last couple of days setting up a progress indicator for a
private site that only does a couple uploads a day. After figuring out
there was no way to set the 'upload_tmp_dir' or 'tmp_name' per
session, I resigned to just doing an opendir() and finding the one
file in 'upload_tmp_dir' since I knew there would never be an issue
with multiple uploads occuring at the same time.

if(is_dir($dir)) {
if ($dh = opendir($dir)) {
while (($file = readdir($dh))) {
if(eregi("php", $file)){
$fp = fopen("$dir$file", "r");
$fstat = fstat($fp);
echo "Bytes uploaded: " . $fstat[7] . "<br>\n";
fclose($fp);
closedir($dh);
$done = 0;
}
}
}
}

This works ok and I just do a JS popup with a meta refresh to show how
many bytes have been uploaded so far. I'm not concerned with knowing
the actual filesize, only showing that the upload is working and how
fast it's working, as you can see in the code above.
This seems to be a very nice hack. Yet, I haven't seen a pure PHP
solution for progress bar. Yet, I haven't tried your solution, but
looks promising. Congrats!
After all this, the question came to mind as to why it would be
difficult or a security problem to prepend or append something like a
timestamp or sid to the tmp_name so that one could reliably figure out
which tmp file they needed to stat? As would be the case with multiple
uploads. I've looked through the PHP source, specifically
php_open_temporary_file.c and don't see what the problem would be, but
then I'm not an expert at C or PHP.

Sorry, no idea.

--
"Success is not what you achieve, but it is what you die for"
If you live in USA, please support John Edwards.
Email: rrjanbiah-at-Y!com

[Andrew Collington]

R. Rajesh Jeba Anbiah wrote:

ro**@linuxdude.com (Ron) wrote in message news:<42**************************@posting.google. com>...

I spent the last couple of days setting up a progress indicator for a
private site that only does a couple uploads a day. After figuring out
there was no way to set the 'upload_tmp_dir' or 'tmp_name' per
session, I resigned to just doing an opendir() and finding the one
file in 'upload_tmp_dir' since I knew there would never be an issue
with multiple uploads occuring at the same time.

if(is_dir($dir)) {
if ($dh = opendir($dir)) {
while (($file = readdir($dh))) {
if(eregi("php", $file)){
$fp = fopen("$dir$file", "r");
$fstat = fstat($fp);
echo "Bytes uploaded: " . $fstat[7] . "<br>\n";
fclose($fp);
closedir($dh);
$done = 0;
}
}
}
}

This works ok and I just do a JS popup with a meta refresh to show how
many bytes have been uploaded so far. I'm not concerned with knowing
the actual filesize, only showing that the upload is working and how
fast it's working, as you can see in the code above.

This seems to be a very nice hack. Yet, I haven't seen a pure PHP
solution for progress bar. Yet, I haven't tried your solution, but
looks promising. Congrats!

There was a patch for the PHP source code that allowed for an upload
meter. You can find information, the patch and demo scripts at:

http://pdoru.from.ro/

Also mentioned in:

http://www.zend.com/zend/week/week140.php
http://www.zend.com/zend/week/week146.php
http://www.zend.com/zend/week/week154.php
http://www.zend.com/zend/week/week161.php

and possibly a few more. :)

I haven't tried the patch, but it does look to be a great solution.

Andy

[R. Rajesh Jeba Anbiah]

Andrew Collington <NO*******************@sussex.ac.uk.NOSPAM> wrote in message news:<c1**********@ames.central.susx.ac.uk>...

R. Rajesh Jeba Anbiah wrote:

> ro**@linuxdude.com (Ron) wrote in message

news:<42**************************@posting.google. com>...

>

>>I spent the last couple of days setting up a progress indicator for a
>>private site that only does a couple uploads a day. After figuring out
>>there was no way to set the 'upload_tmp_dir' or 'tmp_name' per
>>session, I resigned to just doing an opendir() and finding the one
>>file in 'upload_tmp_dir' since I knew there would never be an issue
>>with multiple uploads occuring at the same time.
>>
>>if(is_dir($dir)) {
>> if ($dh = opendir($dir)) {
>> while (($file = readdir($dh))) {
>> if(eregi("php", $file)){
>> $fp = fopen("$dir$file", "r");
>> $fstat = fstat($fp);
>> echo "Bytes uploaded: " . $fstat[7] . "<br>\n";
>> fclose($fp);
>> closedir($dh);
>> $done = 0;
>> }
>> }
>> }
>>}
>>
>>This works ok and I just do a JS popup with a meta refresh to show how
>>many bytes have been uploaded so far. I'm not concerned with knowing
>>the actual filesize, only showing that the upload is working and how
>>fast it's working, as you can see in the code above.

>
>
> This seems to be a very nice hack. Yet, I haven't seen a pure PHP
> solution for progress bar. Yet, I haven't tried your solution, but
> looks promising. Congrats!

There was a patch for the PHP source code that allowed for an upload
meter. You can find information, the patch and demo scripts at:

http://pdoru.from.ro/

Also mentioned in:

http://www.zend.com/zend/week/week140.php
http://www.zend.com/zend/week/week146.php
http://www.zend.com/zend/week/week154.php
http://www.zend.com/zend/week/week161.php

and possibly a few more. :)

And the quite famous is <http://www.raditha.com/php/progress.php>
(with bit of Perl) as they claim that can be used without any patch to
PHP.

Ron's solution is very creative and simple.

--
"Success is not what you achieve, but it is what you die for"
If you live in USA, please support John Edwards.
Email: rrjanbiah-at-Y!com

[Ron]

>

http://pdoru.from.ro/

Also mentioned in:

http://www.zend.com/zend/week/week140.php
http://www.zend.com/zend/week/week146.php
http://www.zend.com/zend/week/week154.php
http://www.zend.com/zend/week/week161.php

and possibly a few more. :)

I haven't tried the patch, but it does look to be a great solution.

Andy

Thanks for the info Andy, and kudos to the author. Looks like it was a
a fair amount of work, and he found and fixed an issue with the
apache2 interface in the process.
Ron