PHP move_uploaded_file文件上传失败问题排查求助

问题场景 #

使用以下PHP代码实现文件上传功能：

$uploadedFile = ''; 
if(!empty($_FILES["file"]["name"])){ 
    // File path config 
    $fileName = $_FILES["file"]["name"]; 
    $targetFilePath = 'uploads/'.$fileName; 
    $fileType = pathinfo($targetFilePath, PATHINFO_EXTENSION); 
             
    // Allow certain file formats to upload 
    if(in_array($fileType, $allowTypes)){ 
        // Upload file to the server 
                
        if(move_uploaded_file($_FILES["file"]["tmp_name"], $targetFilePath)){ 
            $uploadedFile = $fileName; 
            $uploadStatus = 1;
        }else{ 
            $uploadStatus = 0; 
            $response['message'] = 'Sorry, there was an error uploading your file.'; 
        } 
    }else{ 
        $uploadStatus = 0; 
        $response['message'] = 'Sorry, only '.implode('/', $allowTypes).' files are allowed to upload.'; 
    } 
} 
         
if($uploadStatus == 1){ 
         
    // Insert form data in the database 
    $sqlInsertFilePath = "insert into soundexercises(filepath) values ('$targetFilePath')";
    $resultFilePath = pg_query($cn, $sqlInsertFilePath);

    if($resultFilePath){ 
        $response['status'] = 1; 
        $response['message'] = 'Form data submitted successfully!'; 
    } 
} 
}else{ 
    $response['message'] = 'Please fill all the mandatory fields.'; 

运行时提示错误：

Sorry, there was an error uploading your file.

查看Apache错误日志得到：

2023-01-22 16:19:25 [:error] [pid 18980:tid 140169504040704] [client 2a02:587:e919:9900:1f9d:65ab:b74b:4248:35136] [client 2a02:587:e919:9900:1f9d:65ab:b74b:4248] ModSecurity: Warning. Match of "rx ^$" against "FILES:file" required. [file "/etc/httpd/conf/modsecurity.d/rules/comodo_free/000_i360_0.conf"] [line "158"] [id "77317957"] [msg "IM360 WAF: Track file upload||File:\xe8\x88\x92\xe6\x9c\x8d shufu.m4a||Size:20084||User:yskapell||SC:/var/www/vhosts/kaiqiaozhi.space/lxxxxxxx/exercises/upload_sound.php||T:APACHE||"] [severity "NOTICE"] [tag "service_i360custom"] [tag "noshow"] [hostname "xxxxxxx"] [uri "/exercises/upload_sound.php"] [unique_id "Y81F7YHZV4SyzQDeQqbhegAAAdM"], referer: https://xxxxxxx/admin/dashboard.php

2023-01-22 16:19:25 [:error] [pid 18980:tid 140169504040704] [client 2a02:587:e919:9900:1f9d:65ab:b74b:4248:35136] [client 2a02:587:e919:9900:1f9d:65ab:b74b:4248] ModSecurity: Warning. Match of "rx ^$" against "FILES_TMPNAMES:file" required. [file "/etc/httpd/conf/modsecurity.d/rules/comodo_free/000_i360_0.conf"] [line "158"] [id "77317957"] [msg "IM360 WAF: Track file upload||File:/tmp/20230122-161925-Y81F7YHZV4SyzQDeQqbhegAAAdM-file-2buepa||Size:20084||User:yskapell||SC:/var/www/vhosts/kaiqiaozhi.space/xxxxxxx/exercises/upload_sound.php||T:APACHE||"] [severity "NOTICE"] [tag "service_i360custom"] [tag "noshow"] [hostname "xxxxxxx"] [uri "/exercises/upload_sound.php"] [unique_id "Y81F7YHZV4SyzQDeQqbhegAAAdM"], referer: https://xxxxxxx/admin/dashboard.php

2023-01-22 16:19:25 [fcgid:warn] [pid 18980:tid 140169504040704] [client 2a02:587:e919:9900:1f9d:65ab:b74b:4248:35136] mod_fcgid: stderr: PHP Warning: move_uploaded_file(uploads/\xe8\x88\x92\xe6\x9c\x8d shufu.m4a): failed to open stream: No such file or directory in /var/www/vhosts/kaiqiaozhi.space/xxxxxxx/exercises/upload_sound.php on line 63, referer: https://xxxxxxx/admin/dashboard.php

2023-01-22 16:19:25 [fcgid:warn] [pid 18980:tid 140169504040704] [client 2a02:587:e919:9900:1f9d:65ab:b74b:4248:35136] mod_fcgid: stderr: PHP Warning: move_uploaded_file(): Unable to move '/tmp/phpvatIuu' to 'uploads/\xe8\x88\x92\xe6\x9c\x8d shufu.m4a' in /var/www/vhosts/kaiqiaozhi.space/xxxxxxx/exercises/upload_sound.php on line 63, referer: https://xxxxxxx/admin/dashboard.php
2023-01-22 16:19:25 [:error] [pid 18980:tid 140169504040704] [client 2a02:587:e919:9900:1f9d:65ab:b74b:4248:35136] [client 2a02:587:e919:9900:1f9d:65ab:b74b:4248] ModSecurity: Input filter: Failed to rename file from "/tmp/20230122-161925-Y81F7YHZV4SyzQDeQqbhegAAAdM-file-2buepa" to "/var/cache/modsec-upload/20230122-161925-Y81F7YHZV4SyzQDeQqbhegAAAdM-file-2buepa". [hostname "xxxxxxx"] [uri "/exercises/upload_sound.php"] [unique_id "Y81F7YHZV4SyzQDeQqbhegAAAdM"], referer: https://xxxxxxx/dashboard.php

已确认uploads目录权限为755且所有者正确。

更新信息 #

$_FILES['file']['error']返回0，响应信息：

1:0 {"status":0,"message":"Sorry, there was an error uploading your file.","results":"No results"}

原因分析 #

1. 文件路径与编码问题：日志明确提示failed to open stream: No such file or directory，虽然uploads目录权限正确，但：
   • 相对路径uploads/可能未指向正确的物理目录（需确认是否与当前脚本目录对应）；
   • 文件名包含中文（\xe8\x88\x92\xe6\x9c\x8d是中文转义字符），系统编码不兼容会导致路径识别失败。
2. ModSecurity拦截：日志出现ModSecurity缓存文件重命名失败的错误，说明ModSecurity的上传缓存目录权限异常，或规则误拦截了上传流程，导致PHP无法正常访问临时文件。
3. 临时文件权限异常：虽然$_FILES['file']['error']返回0，但ModSecurity可能修改了临时文件的存储路径或权限，导致move_uploaded_file无法读取或移动文件。

解决办法 #

1. 修复文件路径与文件名 #

• 使用绝对路径：替换相对路径为绝对路径，避免路径解析错误：

  $baseDir = dirname(__FILE__); // 获取当前脚本所在目录的绝对路径
  $targetFilePath = $baseDir . '/uploads/' . $fileName;
  

• 处理中文文件名：对中文文件名转码或生成唯一随机文件名，规避编码问题：

  // 方案1：转码（根据系统编码调整）
  $fileName = iconv('UTF-8', 'GBK', $_FILES["file"]["name"]);
  // 方案2：生成唯一文件名，彻底避免编码问题
  $fileName = uniqid() . '.' . $fileType;
  

2. 解决ModSecurity问题 #

• 修复缓存目录权限：确保ModSecurity上传缓存目录拥有web进程的读写权限：

  chmod 755 /var/cache/modsec-upload/
  chown www-data:www-data /var/cache/modsec-upload/ # www-data替换为你的web进程用户
  

• 调整ModSecurity规则：针对规则ID77317957添加例外，或临时禁用测试：
  在ModSecurity配置文件中添加：

  SecRuleRemoveById 77317957
  

• 临时关闭ModSecurity：若确认是规则误拦截，临时关闭ModSecurity后测试上传是否正常，定位问题根源。

3. 添加调试代码 #

在move_uploaded_file前添加调试代码，验证路径正确性：

echo "当前脚本目录：" . dirname(__FILE__) . "<br>";
echo "目标文件路径：" . $targetFilePath . "<br>";
echo "uploads目录存在状态：" . (is_dir(dirname(__FILE__) . '/uploads/') ? '存在' : '不存在') . "<br>";

内容的提问来源于stack exchange，提问作者George Kapellakis