/tmp and /wp-content/uploads/ShortpixelBackups
-
An ongoing gripe about location of files saved in ShortPixel Image Optimizer
Maybe someone else has already reported this and it’s on your roadmap…
Over the years I’ve run into this fairly irritating issue with the ShortPixel Image Optimizer plugin, in that it sometimes tries to save it’s .jpg and .webp files into the server /tmp directory
instead of into /wp-content/uploads/ShortpixelBackups
Are you aware of this, or do you have a plan to mitigate it in the future?IMHO, it does not seem appropriate to me that your plugin would allow the saving of files anywhere but “its own” set directory, like in your case:
public_html/wp-content/uploads/ShortpixelBackups
Thoughts?
___
The fix.
In order to resolve files being saved into the server root directory, I’ve had to manually set for some clients byediting the wp-config-php, like:
define( ‘WP_TEMP_DIR’, ‘/home/usename/public_html/wp-content/tmp/’ );
<rant>
Seriously, a client should not have to research, know that, or implement that. It’s neither fair nor cool; when there should be safeguards in the plugin’s code to limit where files “can be” saved.
Likewise, it seems to me that this is a security issue, and that a plugin should have a wrapper in place to limit where files can be saved (specifically, not outside the client’s public directory).
</rant>
-
You’re correct that the system can clear /tmp, but it’s not a guarantee that the space is safe mid-job. On many cPanel servers, /tmp is cleaned by tools like tmpwatch or on reboot.
It’s also common for shared-hosting providers to allocate a relatively small partition for /tmp.
So if a client is trying to process, say, 100 GB of images and /tmp is only 10 GB, well, you’ve got a potential disaster at play: big file job + small working area = risk of “disk full” or failed operations when /tmp is full.
From a hosting and plugin best-practice standpoint, it’s better if a plugin keeps all its temporary files inside the client’s account (for example, under wp-content/temp).
This way, the client has visibility and control—rather than relying on the server’s root /tmp, which most clients do not have access to in an emergency (like, for instance, when the ShortPixel Image Optimizer plugin fills up /tmp).Hi again, @hackrepair ,
Most hosting providers purge the /tmp folder automatically when it reaches a certain usage percentage so it never really gets to 100% to cause issues, this is also why most PHP scripts also save the temporary files there.
We’ve been having this system in place for years now and never had any users reporting their /tmp getting full because of our plugin, but I totally understand your point about the client side location for the temporary files.
I’ve noted your feedback so I can discuss it with my colleagues to see if there’s anything we can improve in this area in the future!
All the best,
You must be logged in to reply to this topic.
