用PHP上传文件 - 解压缩和移动

Question

I have a very basic, very straightforward function that takes a file (after checking it to make sure its a zip among other things) and uploads it, unpacks it and such:

public function theme(array $file){ 
        global $wp_filesystem;

        if(is_dir($wp_filesystem->wp_content_dir() . "/themes/Aisis-Framework/custom/theme/")){
            $target_path = $wp_filesystem->wp_content_dir() . "/themes/Aisis-Framework/custom/theme/";
            if(move_uploaded_file($file['tmp_name'], $target_path . '/' . $file['name'])) {
                $zip = new ZipArchive();
                $x = $zip->open($target_path);
                if ($x === true) {
                    $zip->extractTo($target_path); // change this to the correct site path
                    $zip->close();

                    //unlink($target_path);
                }
                $this->success('We have uplaoded your new theme! Activate it bellow!');
            } else {    
                $this->error('Oops!', 'Either your zip is corrupted, could not be unpacked or failed to be uploaded. 
                    Please try again.');
            }
        }else{
            $this->error('Missing Directory', 'The Directory theme under custom in Aisis Theme does not exist.');
        }

        if(count(self::$_errors) > 0){
            update_option('show_errors', 'true');
        }

        if(count(self::$_messages) > 0){
            update_option('show_success', 'true');
        }

    }

Extremely basic, yes I have used my target path as both the path to upload too and unpack (should I use a different path, by default it seems to use /tmp/tmp_name)

Note: $file is the array of $_FILES['some_file'];

My question is I get:

Warning: move_uploaded_file(/var/www/wordpress/wp-content//themes/Aisis-Framework/custom/theme//newtheme.zip): failed to open stream: Permission denied in /var/www/wordpress/wp-content/themes/Aisis-Framework/CoreTheme/FileHandling/Upload/Upload.php on line 82

Warning: move_uploaded_file(): Unable to move '/tmp/phpfwechz' to '/var/www/wordpress/wp-content//themes/Aisis-Framework/custom/theme//newtheme.zip' in /var/www/wordpress/wp-content/themes/Aisis-Framework/CoreTheme/FileHandling/Upload/Upload.php on line 82

Which basically means that "oh the folder your trying to move from is owned by root, no you cannot do that." the folder I am moving too is owned by apache, www-data. - I have full read/write/execute (it's localhost).

So question time:

• Should my upload to and move to folder be different?
• How, in a live environment, because this is a WordPress theme, will users who have the ability to upload files be able to get around this "you dont have permission"?

Answer 1

You should try to do it the wordpress way. Uploading all user content to wp-content/uploads, and doing it with the native functions.

As you mention, uploading to a custom directory, may be an issue to non tech savvy users. /uploads already have the special permissions.

Check out wp_handle_upload. You just have to limit the mime type of the file.