update_manager_local_transfers_allowed

update_manager_local_transfers_allowed()

Determines if file transfers will be performed locally.

If the server is configured such that webserver-created files have the same owner as the configuration directory (e.g., sites/default) where new code will eventually be installed, the update manager can transfer files entirely locally, without changing their ownership (in other words, without prompting the user for FTP, SSH or other credentials).

This server configuration is an inherent security weakness because it allows a malicious webserver process to append arbitrary PHP code and then execute it. However, it is supported here because it is a common configuration on shared hosting, and there is nothing Drupal can do to prevent it.

Return value

TRUE if local file transfers are allowed on this server, or FALSE if not.

See also

install_check_requirements()

File

core/modules/update/update.manager.inc, line 304

Administrative screens and processing functions of the Update Manager module.

Code

function update_manager_local_transfers_allowed() {
  // Compare the owner of a webserver-created temporary file to the owner of
  // the configuration directory to determine if local transfers will be
  // allowed.
  $temporary_file = drupal_tempnam('temporary://', 'update_');
  $site_path = \Drupal::service('site.path');
  $local_transfers_allowed = fileowner($temporary_file) === fileowner($site_path);

  // Clean up. If this fails, we can ignore it (since this is just a temporary
  // file anyway).
  @drupal_unlink($temporary_file);

  return $local_transfers_allowed;
}