diff --git a/lib/SimpleSAML/Utils/System.php b/lib/SimpleSAML/Utils/System.php index a61b6784c56e31218fd2881a6ba990bf19961d94..e2c9e8bb46d2542b0d3f78148e258caeed4ccef4 100644 --- a/lib/SimpleSAML/Utils/System.php +++ b/lib/SimpleSAML/Utils/System.php @@ -67,12 +67,13 @@ class System * This function retrieves the path to a directory where temporary files can be saved. * * @return string Path to a temporary directory, without a trailing directory separator. - * @throws Error\Exception If the temporary directory cannot be created or it exists and does not belong - * to the current user. + * @throws Error\Exception If the temporary directory cannot be created or it exists and cannot be written + * to by the current user. * * @author Andreas Solberg, UNINETT AS <andreas.solberg@uninett.no> * @author Olav Morken, UNINETT AS <olav.morken@uninett.no> * @author Jaime Perez, UNINETT AS <jaime.perez@uninett.no> + * @author Aaron St. Clair, ECRS AS <astclair@ecrs.com> */ public static function getTempDir(): string { @@ -86,6 +87,10 @@ class System DIRECTORY_SEPARATOR ); + /** + * If the temporary directory does not exist then attempt to create it. If the temporary directory + * already exists then verify the current user can write to it. Otherwise, throw an error. + */ if (!is_dir($tempDir)) { if (!mkdir($tempDir, 0700, true)) { $error = error_get_last(); @@ -94,14 +99,12 @@ class System (is_array($error) ? $error['message'] : 'no error available') ); } - } elseif (function_exists('posix_getuid')) { - // check that the owner of the temp directory is the current user - $stat = lstat($tempDir); - if ($stat['uid'] !== posix_getuid()) { - throw new Error\Exception( - 'Temporary directory "' . $tempDir . '" does not belong to the current user.' - ); - } + } elseif (!is_writable($tempDir)) { + throw new Error\Exception( + 'Temporary directory "' . $tempDir . + '" cannot be written to by the current user' . + (function_exists('posix_getuid') ? ' "' . posix_getuid() . '"' : '') + ); } return $tempDir; diff --git a/tests/lib/SimpleSAML/Utils/SystemTest.php b/tests/lib/SimpleSAML/Utils/SystemTest.php index 5e60aa29294400d7ac9ee61f3a24289e8eb3e678..1db10d8cac5e8faf2a90a0b891ac275529a9dace 100644 --- a/tests/lib/SimpleSAML/Utils/SystemTest.php +++ b/tests/lib/SimpleSAML/Utils/SystemTest.php @@ -267,23 +267,16 @@ class SystemTest extends TestCase /** - * @requires OS Linux * @covers \SimpleSAML\Utils\System::getTempDir * @test * @return void */ - public function testGetTempDirBadOwner() + public function testGetTempDirBadPermissions() { - if (!function_exists('posix_getuid')) { - static::markTestSkipped('POSIX-functions not available; skipping!'); - } - - $bad_uid = posix_getuid() + 1; - $tempdir = $this->root_directory . DIRECTORY_SEPARATOR . self::DEFAULTTEMPDIR; $config = $this->setConfigurationTempDir($tempdir); - chown($tempdir, $bad_uid); + chmod($tempdir, 0440); $this->expectException(\SimpleSAML\Error\Exception::class); System::getTempDir();