Add optional setting to use system temp directory for H5P temporary files

admin/class-h5p-plugin-admin.php

@@ -495,6 +495,10 @@ public function display_settings_page() {
 
       $send_usage_statistics = filter_input(INPUT_POST, 'send_usage_statistics', FILTER_VALIDATE_BOOLEAN);
       update_option('h5p_send_usage_statistics', $send_usage_statistics);
+
+      $use_system_temp_dir = filter_input(INPUT_POST, 'use_system_temp_dir', FILTER_VALIDATE_BOOLEAN);
+      update_option('h5p_use_system_temp_dir', $use_system_temp_dir);
+
     }
     else {
       $frame = get_option('h5p_frame', TRUE);
@@ -511,6 +515,7 @@ public function display_settings_page() {
       $enable_hub = get_option('h5p_hub_is_enabled', TRUE);
 //      $site_key = get_option('h5p_site_key', get_option('h5p_h5p_site_uuid', FALSE));
       $send_usage_statistics = get_option('h5p_send_usage_statistics', TRUE);
+      $use_system_temp_dir = get_option('h5p_use_system_temp_dir', FALSE);
     }
 
     // Attach disable hub configuration

admin/views/settings.php

@@ -211,6 +211,18 @@ class="h5p-settings-disable-hub-checkbox"
             </p>
           </td>
         </tr>
+        <tr valign="top">
+          <th scope="row"><?php _e("Temporary Storage Location", $this->plugin_slug); ?></th>
+          <td>
+            <label>
+              <input name="use_system_temp_dir" type="checkbox" value="true"<?php if ($use_system_temp_dir): ?> checked="checked"<?php endif; ?>/>
+              <?php _e("Use system temporary folder", $this->plugin_slug); ?>
+            </label>
+            <p class="h5p-setting-desc">
+              <?php _e("When enabled, H5P will store temporary files (such as uploads during editing) in your server's system temporary folder instead of the plugin directory. This can improve performance on servers with limited resources.", $this->plugin_slug); ?>
+            </p>
+          </td>
+        </tr>
       </tbody>
     </table>
     <?php wp_nonce_field('h5p_settings', 'save_these_settings'); ?>

public/class-h5p-plugin.php

@@ -396,6 +396,7 @@ public static function update_database() {
     add_option('h5p_hub_is_enabled', FALSE);
     add_option('h5p_send_usage_statistics', FALSE);
     add_option('h5p_has_request_user_consent', FALSE);
+    add_option('h5p_use_system_temp_dir', FALSE);
   }
 
   /**
@@ -1734,6 +1735,7 @@ public static function uninstall() {
     delete_option('h5p_check_h5p_requirements');
     delete_option('h5p_hub_is_enabled');
     delete_option('h5p_send_usage_statistics');
+    delete_option('h5p_use_system_temp_dir');
     delete_option('h5p_has_request_user_consent');
 
     // Clean out file dirs.
@@ -1755,6 +1757,14 @@ public static function uninstall() {
     if (is_dir($path) && count(scandir($path)) === 2) {
       rmdir($path);
     }
+
+    // Remove the staging dir in the system temp dir, but only if it's empty.
+    // It is shared by all sites in a network and may hold uploads in progress,
+    // and it is recreated on demand, so it must never be removed recursively.
+    $system_tmp = H5PWordPress::getSystemTmpParentPath();
+    if (is_dir($system_tmp) && count(scandir($system_tmp)) === 2) {
+      rmdir($system_tmp);
+    }
   }
 
   /**

public/class-h5p-wordpress.php

@@ -94,16 +94,67 @@ public function getLibraryFileUrl($libraryFolderName, $fileName) {
     return $upload_dir['baseurl'] . '/h5p/libraries/' . $libraryFolderName . '/' . $fileName;
   }
 
+  /**
+   * Get path to the folder H5P stages uploads in inside the system temp
+   * directory. Derived from the WordPress installation path, so installations
+   * sharing a server do not share a staging folder. Note that all sites in a
+   * network do share it.
+   *
+   * @return string
+   */
+  public static function getSystemTmpParentPath() {
+    return rtrim(sys_get_temp_dir(), '/\\') . '/h5p-' . substr(md5(ABSPATH), 0, 8);
+  }
+
+  /**
+   * Get path to a new unique tmp folder inside the system temp directory.
+   *
+   * Staging happens in a dedicated, non-listable subfolder rather than
+   * directly in the system temp directory, so other local users can not
+   * predict and pre-create the paths we are about to write to.
+   *
+   * @return string|bool
+   *  Unique path without extension, or FALSE if the system temp directory
+   *  can not be used (missing, not writable or outside open_basedir).
+   */
+  private function getSystemTmpPath() {
+    $parent = self::getSystemTmpParentPath();
+
+    // Suppress warnings, an unusable temp dir is handled by the return value.
+    if (!@wp_mkdir_p($parent) || !@is_writable($parent)) {
+      return FALSE;
+    }
+    @chmod($parent, 0700);
+
+    // Using wp_generate_password() to generate string to use as part of the
+    // parent directory name
+    return $parent . '/h5p-' . wp_generate_password(16, FALSE);
+  }
+
+  /**
+   * Helper, get path to the H5P tmp folder in the plugin directory.
+   */
+  private function getPluginTmpPath() {
+    $plugin = H5P_Plugin::get_instance();
+    $core = $plugin->get_h5p_instance('core');
+    return $core->fs->getTmpPath();
+  }
+
   /**
    * Implements getUploadedH5PFolderPath
    */
   public function getUploadedH5pFolderPath() {
     static $dir;
 
     if (is_null($dir)) {
-      $plugin = H5P_Plugin::get_instance();
-      $core = $plugin->get_h5p_instance('core');
-      $dir = $core->fs->getTmpPath();
+      if (get_option('h5p_use_system_temp_dir', FALSE)) {
+        $dir = $this->getSystemTmpPath();
+      }
+
+      if (empty($dir)) {
+        // Not using or unable to use the system temp dir, fall back.
+        $dir = $this->getPluginTmpPath();
+      }
     }
 
     return $dir;
@@ -116,9 +167,16 @@ public function getUploadedH5pPath() {
     static $path;
 
     if (is_null($path)) {
-      $plugin = H5P_Plugin::get_instance();
-      $core = $plugin->get_h5p_instance('core');
-      $path = $core->fs->getTmpPath() . '.h5p';
+      if (get_option('h5p_use_system_temp_dir', FALSE)) {
+        $path = $this->getSystemTmpPath();
+      }
+
+      if (empty($path)) {
+        // Not using or unable to use the system temp dir, fall back.
+        $path = $this->getPluginTmpPath();
+      }
+
+      $path .= '.h5p';
     }
 
     return $path;