Writable directory but still secure? 2

[ThomasJSmart]

Hi,,

On my webserver i want to chmod a directory so my php scripts can write files to it. How can i make this secure tho? Does making it writable for my php scripts make it writable in other ways?

I have already stopped the uploader in the site from alowing files that could contain php code (.php .html .phtml etc.).

Thank you,
Thomas

I learned a bit yesterday, today i learned a lot, imagine what i'll learn tomorrow!

 

[QatQat]

File upload from PHP is generally safe; do not give public access to that directory and, especially, make sure that the directory where files should be saved is not in the apache webroot.

You may then chmod 740 the folder you are going to write to.

QatQat

Life is what happens when you are making other plans.

 

[ThomasJSmart]

well thats kind of the problem... the folder has to have public read access..... :/ i was worried that part would be difficult...

I learned a bit yesterday, today i learned a lot, imagine what i'll learn tomorrow!

 

[sleipnir214]

Typically, PHP handles file uploads by writing the files to a temporary location on the filesystem. On Linux by default this location is /tmp.

PHP then provides builtin commands for moving the files to a publicly-available location, one such command being move_uploaded_file(). The directory to where PHP moves the files must be writeable by the user as which Apache runs, but does not have to be world-writeable.





Want the best answers? Ask the best questions! TANSTAAFL!

 

[ThomasJSmart]

ah.. ok, so its upload to user writable tmp folder, then system moves to system writable folder.
i can deffently do something with that info, cheers!

I learned a bit yesterday, today i learned a lot, imagine what i'll learn tomorrow!

 

[sleipnir214]

Partially correct.

It's not "then system moves to system writable folder" it's "PHP script, when programmed to do so, moves the file to another folder". The process is not automatic.



Want the best answers? Ask the best questions! TANSTAAFL!