When uploading a file by a HTML form to a PHP script, the uploaded file will remain in upload_tmp_dir, even when the request ended and this file was not removed explicitly by the PHP code.
Expected behavior: Unused, not moved or deleted temp files of a file upload are deleted by PHP when the request ended. This is also the behavior php.net describes for file uploads: "The file will be deleted from the temporary directory at the end of the request if it has not been moved away or renamed.", see: http://php.net/manual/en/features.file-upload.post-method.php
This is, was happens under the hood:
The file is created in upload_tmp_dir. The file is not touched by the PHP code. The request ends. PHP tries to delete the temporary file, but the access is denied.
We analyzed this with procmon. What you can see there is, that php-cgi.exe process seems not impersonate on the delete request like on move_uploaded_file().
Workaround: If we add MODIFY rights for IIS_IUSRS group on uploaded_tmp_dir the file will be deleted after the request ended as expected.
Environment: PHP 5.3/5.4 via FCGI on IIS 7.x
Reproduced on WS2012, WS2008 R2.
I am discussing this in PHP bugtracker, but they do not believe me: https://bugs.php.net/bug.php?id=68535
I need some support of this topic. Can sombody reproduce this? What I am doing wrong.
