Update changelog

https://forum.virtualmin.com/t/upload-progress-bar-not-showing/136374?u=ilia

CHANGELOG.md

@@ -2,7 +2,9 @@
 
 #### 2.621 (January 25, 2026)
 * Fix to prevent NAT from dropping idle RPC sessions during long transfers
-* Fix MySQL/MariaDB module to correctly check the version when plugins became available
+* Fix to improve the message when socket authentication is used in the MySQL/MariaDB module
+* Fix to make upload tracking work correctly in all situations and on all systems
+* Fix to correctly display the PHP version in the PHP Configuration module when managing packages
 
 #### 2.620 (January 9, 2026)
 * Add ability to use correct driver depending on the database in MySQL/MariaDB module

phpini/list_pkgs.cgi

@@ -61,9 +61,7 @@ if (&foreign_installed("package-updates")) {
 		my @allpkgs = &extend_installable_php_packages(\@newpkgs);
 		@allpkgs = sort { $b->{'ver'} cmp $a->{'ver'} } @allpkgs;
 		print &ui_select("u", undef,
-			[ map { [ $_->{'name'},
-				"PHP ". ($_->{'ver'} == 5 ? '5.6' : $_->{'ver'})
-				] } @allpkgs ]);
+			[ map { [ $_->{'name'}, "PHP $_->{'ver'}" ] } @allpkgs ]);
 		print &ui_hidden(
 			"redir", &get_webprefix()."/$module_name/list_pkgs.cgi");
 		print &ui_hidden("redirdesc", $text{'pkgs_title'});

phpini/phpini-lib.pl

@@ -1047,7 +1047,8 @@ my @pkgs;
 my @extra = ('cli', 'fpm');
 foreach my $pkg (@{$pkgs}) {
 	my $p = { 'name' => $pkg->{'name'},
-		  'ver'  => $pkg->{'shortver'} };
+		  'shortver' => $pkg->{'shortver'},
+		  'ver'  => $pkg->{'ver'} };
 	$p->{'name'} .= ' '.join(' ', map { "$1-$_" } @extra)
 		if ($p->{'name'} =~ /^(.*)-common$/);
 	push(@pkgs, $p);

uptracker.cgi

@@ -28,13 +28,7 @@ print "</table></center>\n";
 print "</form>\n";
 
 # Find the location of the user's upload progress file
-if ($in{'uid'}) {
-	@uinfo = getpwuid($in{'uid'});
-	$upfile = "$uinfo[7]/.tmp/upload.$id";
-	}
-else {
-	$upfile = &tempname_dir()."/upload.$id";
-	}
+my $upfile = &tempname_dir_sys()."/upload.$id";
 
 # Read the tracker file in a loop until done, or until 1 minute has passed
 # with no progress

web-lib-funcs.pl

@@ -388,6 +388,58 @@ $str =~ s/["'<>&\\]/sprintf('\x%02x', ord $&)/ge;
 return $str;
 }
 
+=head2 tempname_dir_sys()
+
+Returns a shared base directory for system-wide temporary files. This directory
+does not depend on the current user. The directory is chosen once per process
+and verified by creating a temporary probe file.
+
+The result is cached for the lifetime of the current Perl process.
+
+=cut
+sub tempname_dir_sys
+{
+# Cache per module
+state %base;
+my @can_dirs;
+
+# Return cached value if already determined
+my $mod = &get_module_name() || '';
+return $base{$mod} if (defined $base{$mod});
+
+# Check configured system temp dirs (module override first)
+my $modk = $mod ? "tempdir_sys_$mod" : undef;
+push(@can_dirs, $gconfig{$modk}) if ($modk && $gconfig{$modk});
+push(@can_dirs, $gconfig{'tempdir_sys'}) if ($gconfig{'tempdir_sys'});
+
+# Common fallbacks
+push(@can_dirs, "/dev/shm", "/tmp", "/var/tmp", "/usr/tmp");
+
+# Remove empty and duplicate entries, which can happen when both configured
+# dirs are set to the same path, or when a configured path matches one of
+# the built-in defaults
+@can_dirs = &unique(grep { $_ } @can_dirs);
+
+# Test each candidate in turn
+for my $dir (@can_dirs) {
+	next if (!-d $dir);
+	next if (!-w $dir);
+
+	# Confirm we can actually create a file
+	my $tmp = "$dir/.webmin_${$}_".int(rand(1e16));
+	if (open(my $fh, ">", $tmp)) {
+		close($fh);
+		unlink($tmp);
+		$base{$mod} = $dir;	# Success, cache and return
+		return $base{$mod};
+		}
+	}
+
+my $keys = ($modk && $gconfig{$modk}) ? "$modk or tempdir_sys" : "tempdir_sys";
+&error("No usable system temp directory found. Set $keys to a writable ".
+       "directory in $config_directory/config and try again.");
+}
+
 =head2 tempname_dir()
 
 Returns the base directory under which temp files can be created.
@@ -1011,19 +1063,8 @@ my ($size, $totalsize, $filename, $id) = @_;
 return if ($gconfig{'no_upload_tracker'});
 return if (!$id);
 
-# Create the upload tracking directory - if running as non-root, this has to
-# be under the user's home
-my $vardir;
-if ($<) {
-	my @uinfo = @remote_user_info ? @remote_user_info : getpwuid($<);
-	$vardir = "$uinfo[7]/.tmp";
-	}
-else {
-	$vardir = &tempname_dir();
-	}
-if (!-d $vardir) {
-	&make_dir($vardir, 0755);
-	}
+# Universal upload tracking directory
+my $vardir = &tempname_dir_sys();
 
 # Remove any upload.* files more than 1 hour old
 if (!$main::read_parse_mime_callback_flushed) {
@@ -10869,7 +10910,7 @@ else {
 		&webmin_debug_log($1 eq ">" ? "WRITE" :
 			  $1 eq ">>" ? "APPEND" : "READ", "nul") if ($db);
 		}
-	elsif ($file =~ /^(>|>>)(\/dev\/.*)/ || lc($file) eq "nul") {
+	elsif ($file =~ /^(>|>>)(\/dev\/(?!shm\/).*)/ || lc($file) eq "nul") {
 		# Writes to /dev/null or TTYs don't need to be handled
 		&webmin_debug_log($1 eq ">" ? "WRITE" : "APPEND", $2) if ($db);
 		return open($fh, "<".$file);
@@ -14019,8 +14060,7 @@ return $dir;
 }
 
 # allocate_miniserv_websocket([module], [base-remote-user])
-# Allocate a new websocket and
-# stores it miniserv.conf file
+# Allocate a new websocket and stores it miniserv.conf file
 sub allocate_miniserv_websocket
 {
 my ($module, $buser) = @_;