CODEWITHSUNDEEP
phpfile
user1037355
user1037355

Reputation:

php not writing files to subfolder but will to the webroot

I recently asked a question: Write over a htaccess file?

What I am trying to create is a CMS system for a friend but without storing any ftp details on the said system (Like many other existing systems do such as cushy cms. NB the system will require members to log into my server then transfer the files to their own server from mine.). A work around not having to store other peoples ftp details I have devised is this:

The clients server has a config.php on their server. When the config.php recieves instruction it then attempts to write new files from my sever (my cms system) to a folder within the webroot of their, with the php function fopen.

On several servers i have tested this system on, the config.php cannot write the files to a subfolder within the webroot unless the said subfolder has permissions 777 on it. In the post i mentioned above, both responses heavily suggested not to do this.. (ie not to set 777)

So I did another quick test, it turns out the same config.php sat on the clients server can write to the webroot (in this case 'public_html').

The question

How can a php script at path: $_SERVER['DOCUMENT_ROOT'].'/cmssystem/config.php';

not be able to write to a folder (without permisions 777) such as: $_SERVER['DOCUMENT_ROOT'].'/cmssystem/files/';

but can write the same file to the document_root?? Also will this be the same on most servers?

Upvotes: 0

Views: 637

Answers (1)

Philthi
Philthi

Reputation: 95

This is a really common problem, what is happening here is that some servers are running with suPHP enabled (switch user PHP, also known as suExec) so that PHP executes as the user that owns the hosting account, as this is generally the same user as the owner of the folder you want to write to, you then only need 755 permissions to write to that folder.

However some hosting companies think it is safer for PHP to execute as a generic user (i.e. nobody, apache, etc.), this means that the user PHP runs as, is not the user that owns the folder you are trying to write to, so the other group on that folder needs write permissions (i.e. 777) to be able to write to that directory.

There's not a lot you can do to work around this, other than change the permissions, or change the hosting company of the problematic accounts.

Hope that helps!

Regards, Phil,

Upvotes: 3

Related Questions