In T269508#8254212, @Kghbln wrote:

Here is a solution for Apache users.

Nowadays, more and more web hosting providers use PHP-FPM (and/or php-cgi) to run PHP for each user separately, eliminating the traditional problems with write permissions for www-data when using mod_php. I think therefore it would prove much more useful now than 8 years ago to change behaviour and simplify installation.

In T291750#7404473, @Krinkle wrote:

Chatted with @tstarling, who has fixed similar issues in the past (such as for legacy MS Office files). The MimeAnalyzer currently has quite an outdated and crude implementation for ZIP-like files, based on regular expressions.

We already have a more correct and less vulnerable handler (ZipDirectoryReader) which is currently used during upload checks. We should consider using this in MimeAnalyzer as well as the basis for what detectZipType() currently does.

In T269508#6674691, @cscott wrote:

In T269508#6674241, @matmarex wrote:

Alternatively, maybe it's already possible to do this if you hard-code the HTTP username and password into the URL configured in $wgVirtualRestConfig['modules']['parsoid']['url']?

Yeah, probably. And if that doesn't work, it could probably be made to work.

In T268420#6661117, @tstarling wrote:

I think it's correct for this file to be shared between different wikis, but we could put getmyuid() in the filename to avoid permission errors.

I can confirm that indeed these files are created globally in /tmp , which is problematic whenever more than a single wiki is used. This could even be problematic for non-shared hosting where someone just happens to run two MediaWiki installations. It seems weird the regular functions for creating randomised or prefix temporary files weren't used in this case.

It seems that some of the details for this feature request have changed. Currently, this option is already available for the UploadDialog in both the classic wikieditor and in visualeditor. It's quite confusing when a user sets configuration in https://www.mediawiki.org/wiki/Manual:$wgUploadDialog that it changes the dialogues in both of those editors, but not in the main upload form. This should really be an added reason to reconsider the priority of this bug and its usefulness in the eye of keeping configuration results within MediaWiki consistent as well as managing the expectations of users on what a configuration option does.