[SOAP] Temporary WSDL cache files not being deleted

[Lyrkan]

Description

Hi there,

After upgrading some servers from PHP 8.1.25 to 8.1.26 I started receiving alerts that their disk usage was increasing unusually fast due to thousands of tmp.wsdl.* files being created in the WSDL cache folder.

From what I've seen those temporary files were added in #12469 but I think it may be related to another issue I had before.

PHP scripts from my app are owned by an user called admin and may be executed by two different users :

• admin (CLI)
• www-data (PHP-FPM).

In both cases SOAP APIs may be called which will result in the WSDL cache being populated.
From my understanding, the filenames for those files depend on a php_get_current_user() call which doesn't return the process owner but the owner of the script, which means that in both cases (CLI or PHP-FPM) the files will have the same name.

Since - at least in my case - they are created in the /tmp directory with 600 permissions, only the owner of the process that was used to create them can also read them. So, I basically end-up with files called wsdl-admin-* owned by the first user that populated the WSDL cache (ex: admin) and not readable by the other one (ex: www-data). I'm not sure why it worked before 8.1.26, I'm guessing that it probably didn't but failed silently.

What I think happens next is that the new code from #12469 tries to move the tmp.wsdl.* files to wsdl-admin-<hash> but does not have the permission to do so.

So, two questions:

• is there a reason the cache files are named based on the script file owner and not the PHP process owner?
• shouldn't the tmp.wsdl.* files be removed if they could not be renamed?

PHP Version

PHP 8.1.26

Operating System

Ubuntu 20.04

[nielsdos]

Thanks for the report! Your analysis seems right.

From my understanding, the filenames for those files depend on a php_get_current_user() call which doesn't return the process owner but the owner of the script, which means that in both cases (CLI or PHP-FPM) the files will have the same name.

It's actually even worse. In case the SAPI has set up a custom user to run under then it will return that user... So it's quite inconsistent. (except on Windows where it will always return the current user).

is there a reason the cache files are named based on the script file owner and not the PHP process owner?

Seems like an oversight to me. I'm not going to touch this for stable branches, but I'll take a look to fix this on master.

shouldn't the tmp.wsdl.* files be removed if they could not be renamed?

Yeah that should fix your issue.

I'm not sure why it worked before 8.1.26, I'm guessing that it probably didn't but failed silently.

Yeah the caching just didn't work before. This should be fixable by taking the right username, something that I'll look into for master. For stable branches I'll make sure the temp files are removed.

[Lyrkan]

Hi @nielsdos,

Thanks for taking care of it.

For now as a workaround I moved cache files to their own directory and handle permissions on them using ACLs, seems to do the trick :)