[php-src] Issue #20950: basename() corrupts file path resolution when called between wp_upload_dir() and move_uploaded_file()
[email protected] (smojef)
| Newsgroups | php.bugs |
|---|---|
| Message-ID | <[email protected]> |
Issue: https://github.com/php/php-src/issues/20950
Author: smojef
### Description
```php
$upload_dir = wp_upload_dir();
$test_call = basename('/a/b/c/d.ext'); // This causes the next line to fail
$result = move_uploaded_file($tmp_name, 'uploads/mec_events.xml');
```
```
PHP Warning: move_uploaded_file(uploads/mec_events.xml): Failed to open stream: No such file or directory in /xxxxx/wp-content/test_upload_bug.php on line 153
PHP Warning: move_uploaded_file(): Unable to move '/tmp/phpByMZrs' to 'uploads/mec_events.xml' in /xxxxx/wp-content/test_upload_bug.php on line 153
```
I created the following PHP file to try to identify the root cause of this strange issue and possible workarounds.
Place this PHP file in wp-content of a Wordpress site, run it upload any file that you rename as 'mec_events.xml' to reproduce the problem. For an unknown reason on my hosted server, the following scenarios fail: A1, A2, D, and F1.
```php
<?php
require_once(__DIR__ . '/../wp-load.php');
$result_text = "";
$vars_dump = "";
if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_FILES['testfile']) && isset($_POST['test'])) {
$test_num = $_POST['test'];
if ($test_num == 'A1') {
$test_name = "Baseline problem (fails)";
$files_testfile = $_FILES['testfile'];
$name = $files_testfile['name'];
$tmp_name = $files_testfile['tmp_name'];
// Critical failing scenario is when calling basename() between up_upload_dir() and move_uploaded_file()
$upload_dir = wp_upload_dir();
$base_name = basename($name); // This causes the move to fail
$basedir = $upload_dir['basedir'];
$target = $basedir . '/' . $base_name;
$result = move_uploaded_file($tmp_name, $target);
$vars = [
'name' => $name,
'pre_target' => $pre_target,
'tmp_name' => $tmp_name,
'base_name' => $base_name,
'target' => $target,
'result' => $result ? 'true' : 'false'
];
} else if ($test_num == 'A2') {
$test_name = "No prior influence (fails)";
// Make sure that usleep() or file_exists() before critical section does not solve the problem
$pre_target = 'uploads/mec_events.xml';
usleep(50000);
$file_exists_before = file_exists($pre_target);
$files_testfile = $_FILES['testfile'];
$name = $files_testfile['name'];
$tmp_name = $files_testfile['tmp_name'];
// Critical failing scenario is when calling basename() between up_upload_dir() and move_uploaded_file()
$upload_dir = wp_upload_dir();
$base_name = basename($name); // This causes the move to fail
$basedir = $upload_dir['basedir'];
$target = $basedir . '/' . $base_name;
$result = move_uploaded_file($tmp_name, $target);
$real_pre_target = realpath($pre_target);
$real_target = realpath($target);
$same_targets = ($real_target !== false && $real_pre_target !== false && $real_target === $real_pre_target);
$vars = [
'name' => $name,
'pre_target' => $pre_target,
'tmp_name' => $tmp_name,
'base_name' => $base_name,
'target' => $target,
'same_targets' => $same_targets ? 'true' : 'false',
'result' => $result ? 'true' : 'false'
];
} elseif ($test_num == 'B1') {
$test_name = "basename moved before (success)";
$files_testfile = $_FILES['testfile'];
$name = $files_testfile['name'];
$tmp_name = $files_testfile['tmp_name'];
$base_name = basename($name); // Moved outside
// No function calls between up_upload_dir() and move_uploaded_file()
$upload_dir = wp_upload_dir();
$basedir = $upload_dir['basedir'];
$target = $basedir . '/' . $base_name;
$result = move_uploaded_file($tmp_name, $target);
$vars = [
'name' => $name,
'tmp_name' => $tmp_name,
'base_name' => $base_name,
'target' => $target,
'result' => $result ? 'true' : 'false'
];
} elseif ($test_num == 'B2') {
$test_name = "No other call in between (success)";
// No function calls between up_upload_dir() and move_uploaded_file()
$upload_dir = wp_upload_dir();
$files_testfile = $_FILES['testfile'];
$name = $files_testfile['name'];
$tmp_name = $files_testfile['tmp_name'];
$base_name = 'mec_events.xml'; // Removed call
$basedir = $upload_dir['basedir'];
$target = $basedir . '/' . $base_name;
$result = move_uploaded_file($tmp_name, $target);
$vars = [
'name' => $name,
'tmp_name' => $tmp_name,
'target' => $target,
'result' => $result ? 'true' : 'false'
];
} elseif ($test_num == 'C') {
$test_name = "Existing target and no other call in between (success)";
$pre_target = 'uploads/mec_events.xml';
usleep(50000);
$file_created = file_put_contents($pre_target, 'dummy content');
usleep(50000);
$file_exists_before = file_exists($pre_target);
$files_testfile = $_FILES['testfile'];
$name = $files_testfile['name'];
$tmp_name = $files_testfile['tmp_name'];
// Critical section
$upload_dir = wp_upload_dir();
$basedir = $upload_dir['basedir'];
$target = $basedir . '/mec_events.xml'; // Hard coded, no basename
$result = move_uploaded_file($tmp_name, $target);
$real_pre_target = realpath($pre_target);
$real_target = realpath($target);
$same_targets = ($real_target !== false && $real_pre_target !== false && $real_target === $real_pre_target);
$vars = [
'name' => $name,
'pre_target' => $pre_target,
'tmp_name' => $tmp_name,
'target' => $target,
'file_created_before' => $file_created !== false ? 'YES' : 'NO',
'file_exists_before_wp_upload_dir' => $file_exists_before ? 'YES' : 'NO',
'same_targets' => $same_targets ? 'true' : 'false',
'result' => $result ? 'true' : 'false'
];
} elseif ($test_num == 'D') {
$test_name = "Unrelated basename() call in between (fails)";
$rand_path = '/a/b/c/d.ext';
$files_testfile = $_FILES['testfile'];
$name = $files_testfile['name'];
$tmp_name = $files_testfile['tmp_name'];
$pre_target = 'uploads/mec_events.xml';
// Critical section (minimal form)
$upload_dir = wp_upload_dir();
$test_call = basename('/a/b/c/d.ext'); // Unrelated inexisting path
$result = move_uploaded_file($tmp_name, 'uploads/mec_events.xml');
$base_name = basename($name); // After success
$basedir = $upload_dir['basedir'];
$target = $basedir . '/' . $base_name;
$real_pre_target = realpath($pre_target);
$real_target = realpath($target);
$same_targets = ($real_target !== false && $real_pre_target !== false && $real_target === $real_pre_target);
$vars = [
'name' => $name,
'tmp_name' => $tmp_name,
'target' => $target,
'test_call' => $test_call,
'same_targets' => $same_targets ? 'true' : 'false',
'result' => $result ? 'true' : 'false'
];
} elseif ($test_num == 'E1') {
$test_name = "usleep(0) before basename() (success)";
$rand_path = '/a/b/c/d.ext';
$files_testfile = $_FILES['testfile'];
$name = $files_testfile['name'];
$tmp_name = $files_testfile['tmp_name'];
// Critical section
$upload_dir = wp_upload_dir();
$basedir = $upload_dir['basedir'];
$target = $basedir . '/mec_events.xml';
usleep(0);
$base_name = basename($rand_path);
$result = move_uploaded_file($tmp_name, $target);
$vars = [
'name' => $name,
'tmp_name' => $tmp_name,
'target' => $target,
'base_name' => $base_name,
'result' => $result ? 'true' : 'false'
];
} elseif ($test_num == 'E2') {
$test_name = "usleep(0) after basename() (success)";
$rand_path = '/a/b/c/d.ext';
$files_testfile = $_FILES['testfile'];
$name = $files_testfile['name'];
$tmp_name = $files_testfile['tmp_name'];
// Critical section
$upload_dir = wp_upload_dir();
$basedir = $upload_dir['basedir'];
$target = $basedir . '/mec_events.xml';
$base_name = basename($rand_path);
usleep(0);
$result = move_uploaded_file($tmp_name, $target);
$vars = [
'name' => $name,
'tmp_name' => $tmp_name,
'target' => $target,
'base_name' => $base_name,
'result' => $result ? 'true' : 'false'
];
} elseif ($test_num == 'F1') {
$test_name = "file_exists() before basename() (fail)";
$rand_path = '/a/b/c/d.ext';
$files_testfile = $_FILES['testfile'];
$name = $files_testfile['name'];
$tmp_name = $files_testfile['tmp_name'];
// Critical section
$upload_dir = wp_upload_dir();
$basedir = $upload_dir['basedir'];
$target = $basedir . '/mec_events.xml';
$file_exists_result = file_exists($target);
$base_name = basename($rand_path);
$result = move_uploaded_file($tmp_name, $target);
$vars = [
'name' => $name,
'tmp_name' => $tmp_name,
'target' => $target,
'file_exists_result' => $file_exists_result ? 'true' : 'false',
'base_name' => $base_name,
'result' => $result ? 'true' : 'false'
];
} elseif ($test_num == 'F2') {
$test_name = "file_exists() after basename() (success)";
$rand_path = '/a/b/c/d.ext';
$files_testfile = $_FILES['testfile'];
$name = $files_testfile['name'];
$tmp_name = $files_testfile['tmp_name'];
// Critical section
$upload_dir = wp_upload_dir();
$basedir = $upload_dir['basedir'];
$target = $basedir . '/mec_events.xml';
$base_name = basename($rand_path);
$file_exists_result = file_exists($target);
$result = move_uploaded_file($tmp_name, $target);
$vars = [
'name' => $name,
'tmp_name' => $tmp_name,
'target' => $target,
'file_exists_result' => $file_exists_result ? 'true' : 'false',
'base_name' => $base_name,
'result' => $result ? 'true' : 'false'
];
} elseif ($test_num == 'G') {
$test_name = "clearstatcache() and basename() (success)";
$rand_path = '/a/b/c/d.ext';
$files_testfile = $_FILES['testfile'];
$name = $files_testfile['name'];
$tmp_name = $files_testfile['tmp_name'];
// Critical section
$upload_dir = wp_upload_dir();
$test_call = clearstatcache(true);
$base_name = basename($name);
$basedir = $upload_dir['basedir'];
$target = $basedir . '/' . $base_name;
$result = move_uploaded_file($tmp_name, $target);
$vars = [
'name' => $name,
'tmp_name' => $tmp_name,
'target' => $target,
'test_call' => $test_call,
'base_name' => $base_name,
'result' => $result ? 'true' : 'false'
];
} elseif ($test_num == 'H') {
$test_name = "pathinfo() instead of basename() in between (success)";
$rand_path = '/a/b/c/d.ext';
$files_testfile = $_FILES['testfile'];
$name = $files_testfile['name'];
$tmp_name = $files_testfile['tmp_name'];
// Critical section
$upload_dir = wp_upload_dir();
$base_name = pathinfo($name, PATHINFO_BASENAME); // Instead of basename
$basedir = $upload_dir['basedir'];
$target = $basedir . '/' . $base_name;
$result = move_uploaded_file($tmp_name, $target);
$vars = [
'name' => $name,
'tmp_name' => $tmp_name,
'target' => $target,
'base_name' => $base_name,
'result' => $result ? 'true' : 'false'
];
} elseif ($test_num == 'I') {
$test_name = "dirname() instead of basename() in between";
$rand_path = '/a/b/c/d.ext';
$files_testfile = $_FILES['testfile'];
$name = $files_testfile['name'];
$tmp_name = $files_testfile['tmp_name'];
// Critical section
$upload_dir = wp_upload_dir();
$basedir = $upload_dir['basedir'];
$target = $basedir . '/mec_events.xml';
$test_call = dirname($rand_path);
$result = move_uploaded_file($tmp_name, $target);
$vars = [
'name' => $name,
'tmp_name' => $tmp_name,
'target' => $target,
'test_call' => $test_call,
'result' => $result ? 'true' : 'false'
];
} elseif ($test_num == 'J') {
$test_name = "realpath() instead in between (success)";
$rand_path = '/a/b/c/d.ext';
$files_testfile = $_FILES['testfile'];
$name = $files_testfile['name'];
$tmp_name = $files_testfile['tmp_name'];
// Critical section
$upload_dir = wp_upload_dir();
$basedir = $upload_dir['basedir'];
$target = $basedir . '/mec_events.xml';
$test_call = realpath($rand_path);
$result = move_uploaded_file($tmp_name, $target);
$vars = [
'name' => $name,
'tmp_name' => $tmp_name,
'target' => $target,
'test_call' => $test_call,
'result' => $result ? 'true' : 'false'
];
} elseif ($test_num == 'K') {
$test_name = "is_file() instead in between (success)";
$rand_path = '/a/b/c/d.ext';
$files_testfile = $_FILES['testfile'];
$name = $files_testfile['name'];
$tmp_name = $files_testfile['tmp_name'];
// Critical section
$upload_dir = wp_upload_dir();
$basedir = $upload_dir['basedir'];
$target = $basedir . '/mec_events.xml';
$test_call = is_file($rand_path);
$result = move_uploaded_file($tmp_name, $target);
$vars = [
'name' => $name,
'tmp_name' => $tmp_name,
'target' => $target,
'test_call' => $test_call,
'result' => $result ? 'true' : 'false'
];
}
if ($result) @unlink($target);
$vars_dump = print_r($vars, true);
$result_text = "Test $test_num: $test_name = " . ($result ? "SUCCESS ✓" : "FAIL ✗");
error_log($result_text);
error_log("Variables: " . json_encode($vars));
}
?>
<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8">
<title>Tests PHP Wordpress Import Issues</title>
<style>
body {
font-family: Arial, sans-serif;
max-width: 900px;
margin: 40px auto;
padding: 20px;
}
h1 { color: #333; }
.discovery {
background: #c8e6c9;
border-left: 4px solid #4CAF50;
padding: 15px;
margin: 20px 0;
}
.form-container {
background: #f5f5f5;
padding: 20px;
border-radius: 8px;
margin: 20px 0;
}
.test-option {
margin: 10px 0;
padding: 10px;
background: white;
border-left: 4px solid #2196F3;
font-size: 14px;
}
.test-option input[type="radio"] {
margin-right: 10px;
}
button {
background: #2196F3;
color: white;
border: none;
padding: 12px 24px;
font-size: 16px;
border-radius: 4px;
cursor: pointer;
margin: 5px;
}
.result-box {
background: #e8f5e9;
border: 2px solid #4CAF50;
padding: 20px;
margin: 20px 0;
border-radius: 8px;
font-family: monospace;
font-size: 18px;
font-weight: bold;
text-align: center;
}
.result-box.fail {
background: #ffebee;
border-color: #f44336;
}
.vars-box {
background: #fafafa;
border: 1px solid #ccc;
padding: 15px;
margin: 20px 0;
font-family: monospace;
font-size: 12px;
overflow-x: auto;
white-space: pre;
}
</style>
</head>
<body>
<h1>🔬 Upload any text file renamed 'mec_events.xml'</h1>
<div class="form-container">
<form method="post" enctype="multipart/form-data">
<div class="test-option"><label><input type="radio" name="test" value="A1" required><strong>Test A1: ✗</strong></label></div>
<div class="test-option"><label><input type="radio" name="test" value="A2" required><strong>Test A2: ✗</strong></label></div>
<div class="test-option"><label><input type="radio" name="test" value="B1" required><strong>Test B1: ✓</strong></label></div>
<div class="test-option"><label><input type="radio" name="test" value="B2" required><strong>Test B2: ✓</strong></label></div>
<div class="test-option"><label><input type="radio" name="test" value="C" required><strong>Test C: ✓</strong></label></div>
<div class="test-option"><label><input type="radio" name="test" value="D" required><strong>Test D: ✗</strong></label></div>
<div class="test-option"><label><input type="radio" name="test" value="E1" required><strong>Test E1: ✓</strong></label></div>
<div class="test-option"><label><input type="radio" name="test" value="E2" required><strong>Test E2: ✓</strong></label></div>
<div class="test-option"><label><input type="radio" name="test" value="F1" required><strong>Test F1: ✗</strong></label></div>
<div class="test-option"><label><input type="radio" name="test" value="F2" required><strong>Test F2: ✓</strong></label></div>
<div class="test-option"><label><input type="radio" name="test" value="G" required><strong>Test G: ✓</strong></label></div>
<div class="test-option"><label><input type="radio" name="test" value="H" required><strong>Test H: ✓</strong></label></div>
<div class="test-option"><label><input type="radio" name="test" value="I" required><strong>Test I: ✓</strong></label></div>
<div class="test-option"><label><input type="radio" name="test" value="J" required><strong>Test J: ✓</strong></label></div>
<div class="test-option"><label><input type="radio" name="test" value="K" required><strong>Test K: ✓</strong></label></div>
<input type="file" name="testfile" required style="margin: 15px 0; font-size: 16px;">
<br>
<button type="submit">▶️ Import</button>
</form>
</div>
<?php if ($result_text): ?>
<div class="result-box <?php echo strpos($result_text, 'FAIL') !== false ? 'fail' : ''; ?>" id="resultBox">
<?php echo htmlspecialchars($result_text); ?>
</div>
<h3>Variables :</h3>
<div class="vars-box" id="varsBox"><?php echo htmlspecialchars($vars_dump); ?></div>
<button onclick="window.location.href=window.location.pathname">🔄 Restart</button>
<?php endif; ?>
</body>
</html>
<!--
Log Results:
[16-Jan-2026 06:53:15 UTC] PHP Warning: move_uploaded_file(/xxxxx/wp-content/uploads/mec_events.xml): Failed to open stream: No such file or directory in /xxxxx/wp-content/test_upload_bug.php on line 23
[16-Jan-2026 06:53:15 UTC] PHP Warning: move_uploaded_file(): Unable to move '/tmp/phpGbqaSy' to '/xxxxx/wp-content/uploads/mec_events.xml' in /xxxxx/wp-content/test_upload_bug.php on line 23
[16-Jan-2026 06:53:15 UTC] PHP Warning: Undefined variable $pre_target in /xxxxx/wp-content/test_upload_bug.php on line 27
[16-Jan-2026 06:53:15 UTC] Test A1: Baseline problem (fails) = FAIL ✗
[16-Jan-2026 06:53:15 UTC] Variables: {"name":"mec_events.xml","pre_target":null,"tmp_name":"\/tmp\/phpGbqaSy","base_name":"mec_events.xml","target":"\/xxxxx\/wp-content\/uploads\/mec_events.xml","result":"false"}
[16-Jan-2026 06:53:34 UTC] PHP Warning: move_uploaded_file(/xxxxx/wp-content/uploads/mec_events.xml): Failed to open stream: Connection reset by peer in /xxxxx/wp-content/test_upload_bug.php on line 55
[16-Jan-2026 06:53:34 UTC] PHP Warning: move_uploaded_file(): Unable to move '/tmp/php0ZeaZZ' to '/xxxxx/wp-content/uploads/mec_events.xml' in /xxxxx/wp-content/test_upload_bug.php on line 55
[16-Jan-2026 06:53:34 UTC] Test A2: No prior influence (fails) = FAIL ✗
[16-Jan-2026 06:53:34 UTC] Variables: {"name":"mec_events.xml","pre_target":"uploads\/mec_events.xml","tmp_name":"\/tmp\/php0ZeaZZ","base_name":"mec_events.xml","target":"\/xxxxx\/wp-content\/uploads\/mec_events.xml","same_targets":"true","result":"false"}
[16-Jan-2026 06:53:43 UTC] Test B1: basename moved before (success) = SUCCESS ✓
[16-Jan-2026 06:53:43 UTC] Variables: {"name":"mec_events.xml","tmp_name":"\/tmp\/php4AUAsz","base_name":"mec_events.xml","target":"\/xxxxx\/wp-content\/uploads\/mec_events.xml","result":"true"}
[16-Jan-2026 06:53:52 UTC] Test B2: No other call in between (success) = SUCCESS ✓
[16-Jan-2026 06:53:52 UTC] Variables: {"name":"mec_events.xml","tmp_name":"\/tmp\/phpVgkVHg","target":"\/xxxxx\/wp-content\/uploads\/mec_events.xml","result":"true"}
[16-Jan-2026 06:54:00 UTC] Test C: Existing target and no other call in between (success) = SUCCESS ✓
[16-Jan-2026 06:54:00 UTC] Variables: {"name":"mec_events.xml","pre_target":"uploads\/mec_events.xml","tmp_name":"\/tmp\/phpAjc1mr","target":"\/xxxxx\/wp-content\/uploads\/mec_events.xml","file_created_before":"YES","file_exists_before_wp_upload_dir":"YES","same_targets":"true","result":"true"}
[16-Jan-2026 06:54:08 UTC] PHP Warning: move_uploaded_file(uploads/mec_events.xml): Failed to open stream: No such file or directory in /xxxxx/wp-content/test_upload_bug.php on line 157
[16-Jan-2026 06:54:08 UTC] PHP Warning: move_uploaded_file(): Unable to move '/tmp/php5EbII6' to 'uploads/mec_events.xml' in /xxxxx/wp-content/test_upload_bug.php on line 157
[16-Jan-2026 06:54:08 UTC] Test D: Unrelated basename() call in between (fails) = FAIL ✗
[16-Jan-2026 06:54:08 UTC] Variables: {"name":"mec_events.xml","tmp_name":"\/tmp\/php5EbII6","target":"\/xxxxx\/wp-content\/uploads\/mec_events.xml","test_call":"d.ext","same_targets":"true","result":"false"}
[16-Jan-2026 06:54:16 UTC] Test E1: usleep(0) before basename() (success) = SUCCESS ✓
[16-Jan-2026 06:54:16 UTC] Variables: {"name":"mec_events.xml","tmp_name":"\/tmp\/phpZT2Zir","target":"\/xxxxx\/wp-content\/uploads\/mec_events.xml","base_name":"d.ext","result":"true"}
[16-Jan-2026 06:54:23 UTC] Test E2: usleep(0) after basename() (success) = SUCCESS ✓
[16-Jan-2026 06:54:23 UTC] Variables: {"name":"mec_events.xml","tmp_name":"\/tmp\/phpwrxS5n","target":"\/xxxxx\/wp-content\/uploads\/mec_events.xml","base_name":"d.ext","result":"true"}
[16-Jan-2026 06:54:29 UTC] PHP Warning: move_uploaded_file(/xxxxx/wp-content/uploads/mec_events.xml): Failed to open stream: No such file or directory in /xxxxx/wp-content/test_upload_bug.php on line 237
[16-Jan-2026 06:54:29 UTC] PHP Warning: move_uploaded_file(): Unable to move '/tmp/phpUBrwwF' to '/xxxxx/wp-content/uploads/mec_events.xml' in /xxxxx/wp-content/test_upload_bug.php on line 237
[16-Jan-2026 06:54:29 UTC] Test F1: file_exists() before basename() (fail) = FAIL ✗
[16-Jan-2026 06:54:29 UTC] Variables: {"name":"mec_events.xml","tmp_name":"\/tmp\/phpUBrwwF","target":"\/xxxxx\/wp-content\/uploads\/mec_events.xml","file_exists_result":"false","base_name":"d.ext","result":"false"}
[16-Jan-2026 06:54:43 UTC] Test F2: file_exists() after basename() (success) = SUCCESS ✓
[16-Jan-2026 06:54:43 UTC] Variables: {"name":"mec_events.xml","tmp_name":"\/tmp\/phpEaZvV7","target":"\/xxxxx\/wp-content\/uploads\/mec_events.xml","file_exists_result":"true","base_name":"d.ext","result":"true"}
[16-Jan-2026 06:54:50 UTC] Test G: clearstatcache() and basename() (success) = SUCCESS ✓
[16-Jan-2026 06:54:50 UTC] Variables: {"name":"mec_events.xml","tmp_name":"\/tmp\/phpLzVtvc","target":"\/xxxxx\/wp-content\/uploads\/mec_events.xml","test_call":null,"base_name":"mec_events.xml","result":"true"}
[16-Jan-2026 06:55:07 UTC] Test H: pathinfo() instead of basename() in between (success) = SUCCESS ✓
[16-Jan-2026 06:55:07 UTC] Variables: {"name":"mec_events.xml","tmp_name":"\/tmp\/phpMg3keB","target":"\/xxxxx\/wp-content\/uploads\/mec_events.xml","base_name":"mec_events.xml","result":"true"}
[16-Jan-2026 06:55:15 UTC] Test I: dirname() instead of basename() in between = SUCCESS ✓
[16-Jan-2026 06:55:15 UTC] Variables: {"name":"mec_events.xml","tmp_name":"\/tmp\/php1HYUkN","target":"\/xxxxx\/wp-content\/uploads\/mec_events.xml","test_call":"\/a\/b\/c","result":"true"}
[16-Jan-2026 06:55:25 UTC] Test J: realpath() instead in between (success) = SUCCESS ✓
[16-Jan-2026 06:55:25 UTC] Variables: {"name":"mec_events.xml","tmp_name":"\/tmp\/phpdMya0u","target":"\/xxxxx\/wp-content\/uploads\/mec_events.xml","test_call":false,"result":"true"}
[16-Jan-2026 06:55:32 UTC] Test K: is_file() instead in between (success) = SUCCESS ✓
[16-Jan-2026 06:55:32 UTC] Variables: {"name":"mec_events.xml","tmp_name":"\/tmp\/php7gSzrn","target":"\/xxxxx\/wp-content\/uploads\/mec_events.xml","test_call":false,"result":"true"}
-->
```
### PHP Version
```plain
PHP 8.2.28 (cli) (built: Apr 7 2025 13:21:15) (NTS)
Copyright (c) The PHP Group
Zend Engine v4.2.28, Copyright (c) Zend Technologies
with Zend OPcache v8.2.28, Copyright (c), by Zend Technologies
with SourceGuardian v16.0.2, Copyright (c) 2000-2025, by SourceGuardian Ltd.
```
### Operating System
cloudlinux.com 4.18.0-553.8.1.el8_10.x86_64 #1 SMP