Hi James,
Thanks for the reply. Still wondering a bit though...
> PHP programs can only apply chmod() to directories to which
> the web server user has write access.
Hmmm. I think the web server has access. In the root dir of the site are say
directories 'site', 'stylesheets', 'includes' and also 'images'. Inside
'images' is 'fullsize_upl' and 'thumbs_upl'. Self explanatory, not?
In the CMS of the site the user can upload images through a form. Using
getimagesize() I check if they indeed are an image, and if yes store them in
images/fullsize_upl/ and /images/thumbs_upl/ with a name derived from the
respective table and the value of its primary key. The images are recreated
using imageresize to standardize the size of the thumbnails and the fullsize
images.
This means I can conclude that the webserver has write access to these
directories, no?
So why can't I do
chmod('../images/fullsize_upl/',0777);
chmod('../images/thumbs_upl/',0777);
before doing a
if
(move_uploaded_file($_FILES[($Vars[$taTabelInfo->FieldName])]["tmp_name"][$i
], $ImageBigDir.$Filename.$Extension)) {
chmod($ImageBigDir.$Filename.$Extension, 077);
resize_image($ImageBigDir, $ImageBigDir, $Filename, $Extension,
$BigDimensions);
resize_image($ImageBigDir, $ImageSmallDir, $Filename,
$Extension,
$SmallDimensions);
}
> On many file-upload scripts the destination directory is
> given permissions of 777 (rwxrwxrwx) so the owner, group,
> and every other user on the system can write to this directory.
Huh huh. And once in a (very infrequent I must say) while in some way the
rights for '/images/fullsize_upl/' and '/images/thumbs_upl/' get reset to
0644 which is when my CMS script starts failing, the customer mails me, I do
some test, conclude that even a 20 byte .jpg gets rejected, connect with my
FTP client and find the rights reset...
> This technique is risky because it also means that any other
> user on the server can write to the directory, including inserting
arbitrary
> code with a harmful function.
> Any time you allow arbitrary users to upload files to your
> server you introduce
> significant security risks.
Hmmm. The upload form is behind session based password protection, then the
check if the thing is really an image. Plus the filename extension is
determined by the getimagesize() result, not by the original filename
extension.
All hidden inputs on the form always protected by an "if
(in_array($_POST["hidden_var"],$AllowedPostValues) {}". Typically used for
garages who want to manage their stock of vehicles for sale on the website
themselves. Maybe I am missing a security flaw but I thought I had secured
this nicely.
At least there will not be somebody saving the generated form, editing it to
allow for 'own' input (like rewritten hidden variable values), opening it
with his/her webbrowser and then submitting something I don't like...
Actually it would be saver if I could chmod() the directory in the script,
as then it would only be set to 0777 just before moving the uploaded file
the fullsize image directory, and be reset to 0644 immediately after.
Maybe it would work if I would have created the two subdirs not by FTP
(probably a different group/owner) when installing the site but by a PHP
script? Then the webserver would be the owner. Basic question thus still:
can chmod() be done on a dir just like on a file? Something to try...
Marc
Community email addresses:
Post message: [email protected]
Subscribe: [EMAIL PROTECTED]
Unsubscribe: [EMAIL PROTECTED]
List owner: [EMAIL PROTECTED]
Shortcut URL to this page:
http://groups.yahoo.com/group/php-list
Yahoo! Groups Links
<*> To visit your group on the web, go to:
http://groups.yahoo.com/group/php-list/
<*> To unsubscribe from this group, send an email to:
[EMAIL PROTECTED]
<*> Your use of Yahoo! Groups is subject to:
http://docs.yahoo.com/info/terms/
