Home » File Formats » Spreadsheet_Excel_Writer » Bug #9511

[2006-11-30 15:51 UTC] warrenklint at gmail dot com

Description:
------------
We use open_basedir to prevent users accidentally sharing cookies and temporary files between websites.
Each site has their own temporary dir nearer their docroot.

This works really well, apart from with Spreadsheet_Excel_Writer.

The problem is here:

function _initialize()
{
// Open tmp file for storing Worksheet data
$fh = tmpfile();
if ($fh) {
// Store filehandle
$this->_filehandle = $fh;
} else {
// If tmpfile() fails store data in memory
$this->_using_tmpfile = false;
}
}

There are two problems.

The default value for _using_tmpfile, at the beginning of the class, is ignored. The value will always be true.

Allowing a check for the method _using_tmpfile first would solve this:

function _initialize()
{
if ($this->_using_tmpfile == false) {
return;
}

// Open tmp file for storing Worksheet data
$fh = tmpfile();
if ($fh) {
// Store filehandle
$this->_filehandle = $fh;
} else {
// If tmpfile() fails store data in memory
$this->_using_tmpfile = false;
}
}

The second problem is specific to sites which use a shared filesytem for thee data.

Because tmpfile() will return something under "/tmp/", and "/tmp/" is disallowed by open_basedir, php kills the script before it gets a chance to work.

Switching from tmpfile() to tempnam() fixes this.
OLE/PPS/File.php also does this.