On Thu, 10 Sep 2009, Gilad Parann-Nissany wrote:

> CURLPROTO_FILE cannot be activated when in safe_mode or an open_basedir is
> set

...

> However this implies that some of the time (intermittently) the libcurl code
> tries to create some kind of file on my disk; maybe a temp file to cache the
> data I am streaming? And then it hits my deliberate security limitation.

No, that's not what it implies. It implies that the PHP/CURL code somehow
detects something that it prevents you from doing and it tells you about it.
If libcurl itself would do it the PHP/CURL layer would have no idea and
wouldn't be able to tell you.

> I have not asked it to do so - the 'callback' is actually *implementing a
> streaming approach* and so all the request is supposed to be in memory. I
> chose streaming like this to avoid needing too much memory and to avoid the
> overhead of reading/writing anything to disk.
>
> So I am a bit concerned that cURL seems to be writing/reading to disk under
> the hood.

I can tell you that libcurl does no such thing. I cannot tell you if there are
situation when the PHP CURL extension might do so - as I don't know.

> 1. am I correct in the analysis - does libcurl indeed have code that might
> write buffers to the disk sometimes (but not all the time) when using the
> callback mechanism?

Nope, it doesn't.

> 2. can you explain the conditions where this may happen and why?

No, I can't.

> 3. is there any way to configure cURL to control this behavior?

This is not a "cURL" issue, this is a PHP/CURL issue - as in the libcurl
binding for PHP. libcurl doesn't have this behavior.

-- 
  / daniel.haxx.se