0

Recently a web space ran out of space. Now I found out that the tmp folder outside the home directory was full of these files: timthumb_tmpimg_00BZyC. Some of these files can't be opened. Why is timthumb storing files outside the home directory? The tmp folder is on the same level like dev, etc, proc, root, sys and so on.

Has the site a security problem? Are some settings incorrect?

Timthumb is used in version 2.8.5 by the Wordpress plugin vSlider. The site also uses Simple Post Thumbnails which uses Timthumb in v. 2.7. I replaced both with Timthumb 2.8.10.

Or does it have to do with temporary files created by timthumb, which were never deleted?

testing
  • 19,681
  • 50
  • 236
  • 417

1 Answers1

1

/tmp is intended to be world-writeable -- though if you try the following:

ls -l / | grep tmp

you'll see that it has the sticky (t) bit on, meaning that files created by a user can only be deleted by the same user or a superuser, to prevent different users from clobbering each other's temporary files. This is similar to the %SYSTEMDIR%\TEMP directory in Windows.

So it's not a security problem on the Linux side, though it could be a misconfiguration or a bug on the part of the WordPress plugin you're using. Is there an option limiting how many thumbnails it keeps?

michel-slm
  • 9,438
  • 3
  • 32
  • 31
  • No, I didn't found any options. Now I checked the tmp-folder and it seems that there are only a few files. Perhaps it works now. Let's see. – testing Sep 24 '12 at 07:26