CODEWITHSUNDEEP
phpuploadpermissions
JeanSibelius
JeanSibelius

Reputation: 1581

Folder permissions when telling PHP to save a file to that folder?

I'm trying to use this Dagon Design PHP form to help a local non-profit publication enable their readers to submit photos. I've got the "mailer" part working -- the notifications work fine -- but the "saving a file to a folder" part isn't functioning.

On the form page, the author says "the directory must have write permissions," but I'm not sure "who" is writing to that folder -- is this PHP script considered "Owner" when it saves something on my site? Or do I need to allow save permissions for Owner, Group and Others?

I'm not sure why the script isn't saving the photos, but this seems like a good place to start. I've tried looking around on Stack for answers, but most questions seem to have to do with folder creation/permissions.

The page I'm clumsily trying to build is here, if that helps.

Upvotes: 2

Views: 1730

Answers (4)

wally
wally

Reputation: 3592

As Jon has said already, you don't want to allow write access to everyone.

It's also possible (depending on the hosting) that something like suEXEC is being employed - which will cause your PHP script to run as a user other than the webserver's (as reported by Dunhamzzz).

Probably your best approach, in my opinion, is a script calling whoami:

passthru('whoami');

Or alternatively you could try:

var_dump(posix_getpwuid(posix_geteuid()));

Bear in mind, this does give system information away to the world - so delete the script once you've used it!

Then, as you've correctly asserted in your question, it'll likely be the file permissions.

If you do have CLI access, you can update the permissions safely as so (first command gets the group)

id -n -g <username>
chmod 770 <directory>
chown <username>:<group> <directory>

(You may have to pre-pend "sudo" to the "chown" command above, or find other means to run it as "root"..., reply back if you get stuck.)

If you've not got access to run command-line, you'll presumably be doing this via a (S)FTP client or the alike. I'm afraid the options get a little to broad at that point, you'll have to figure it out (or reply back with the client you're using!)

As always, YMMV.

Finally, bear in mind if this is your own code, people will at some point try uploading PHP scripts (or worse). If that directory is accessible via a public URL ... you're opening the hugest of security holes! (.htaccess, or non-document root locations are your friend.)

Upvotes: 1

Dunhamzzz
Dunhamzzz

Reputation: 14798

You'll need to set the permissions of the directory to that of the webserver (probably Apache, nginx or similiar), as that's what is executing the PHP.

You can quickly find out the apache user with ps aux | grep apache, then you want to set the permssions of the upload directory to that user, something like this:

chown -R www-data:www-data images/uploads

Upvotes: 0

Jon
Jon

Reputation: 437336

The PHP script that saves the files is running with the privileges of some user account on the server; the specific account depends on your OS and the web server configuration. On Linux and when PHP is running as an Apache module this user is the same user that Apache runs as.

Solving your problem reduces to determining which user account we are talking about and then ensuring that this user has permission to write to the save directory (either as owner or as a member of the group; giving write access to everyone is not the best idea).

Upvotes: 0

Marcin Orlowski
Marcin Orlowski

Reputation: 75619

If you are not sure how is your server configured (and this would influence who's the final file owner) then add write permission to anyone (chmod a+w folder), upload one file and ls -l to see the owner. Then you can adjust permissions to allow write access to certain users only

Upvotes: 0

Related Questions