> So what to do. Is there a specific command for changing permissions for > directories? Am I making a mistake using chmod? Anything else? > > Marc
PHP programs can only apply chmod() to directories to which the web server user has write access. For example, the Apache web server often runs as a user named "apache" (48) and a group "apache" (48). On many file-upload scripts the destination directory is given permissions of 777 (rwxrwxrwx) so the owner, group, and every other user on the system can write to this directory. This allows the user "apache", under which the PHP scripts run, to write to this directory. This technique is risky because it also means that any other user on the server can write to the directory, including inserting arbitrary code with a harmful function. One measure of protection could be achieved by making a group association for the directory the same as the group used by Apache. The root user can make this change for you. The goal is to have the user association set to your login user and the group set to the same group used by Apache. The permissions for the directory can be changed to 770 (rwxrwx---). With this done your user and the Apache web server can write to this directory. This is not complete protection, however, since under most PHP configurations, any PHP script could write to this upload directory. To provide more protection your sysadmin should look into the php.ini configuration statements like safe_mode and open_basedir. Any time you allow arbitrary users to upload files to your server you introduce significant security risks. James _____ James D. Keeline http://www.Keeline.com http://www.Keeline.com/articles http://Stratemeyer.org http://www.Keeline.com/TSCollection http://www.ITeachPHP.com -- Free Computer Classes: Linux, PHP, etc. Spring Semester Begins Jan 31 -- New Classes Start Every Few Weeks. Community email addresses: Post message: [email protected] Subscribe: [EMAIL PROTECTED] Unsubscribe: [EMAIL PROTECTED] List owner: [EMAIL PROTECTED] Shortcut URL to this page: http://groups.yahoo.com/group/php-list Yahoo! Groups Links <*> To visit your group on the web, go to: http://groups.yahoo.com/group/php-list/ <*> To unsubscribe from this group, send an email to: [EMAIL PROTECTED] <*> Your use of Yahoo! Groups is subject to: http://docs.yahoo.com/info/terms/
