PHP upload permission problem

Question

right guys ive ran into a problem with file permissions with the following upload form. a text file is passed to the upload/ dir by global users.

mysite$ ls -l
drwxrwxrwx 2 user user 4096 2010-09-24 13:07 upload

but as I am not logged in as root, the new file uploaded to the domain saved itself in the upload/ dir with limiting permissions and cannot be modified. eg.

upload$ ls -l
-rw-r--r-- 1 www-data www-data 3067 2010-09-24 13:07 Readme.txt

this problem is obviously the same for all files added to the upload folder by global users. once the file is uploaded I need a way of changing the file rights without embedding the root password into a php script running on the domain. please help!

is there any way to associate the same rights to files as the containing folder when new files are added?

submit form:

<html>
<body>

<form action="upload_file.php" method="post"
enctype="multipart/form-data">
<label for="file">Filename:</label>
<input type="file" name="file" id="file" /> 
<br />
<input type="submit" name="submit" value="Submit" />
</form>

</body>
</html>

upload_file.php:

<?php
if ($_FILES["file"]["type"] == "text/plain")
  {
  if ($_FILES["file"]["error"] > 0)
    {
    echo "Return Code: " . $_FILES["file"]["error"] . "<br />";
    }
  else
    {
    echo "Upload: " . $_FILES["file"]["name"] . "<br />";
    echo "Type: " . $_FILES["file"]["type"] . "<br />";
    echo "Size: " . ($_FILES["file"]["size"] / 1024) . " Kb<br />";
    echo "Temp file: " . $_FILES["file"]["tmp_name"] . "<br />";

    if (file_exists("/home/user/mysite/upload/" . $_FILES["file"]["name"]))
      {
      echo $_FILES["file"]["name"] . " already exists. ";
      }
    else
      {
      move_uploaded_file($_FILES["file"]["tmp_name"],
      "/home/user/mysite/upload/" . $_FILES["file"]["name"]);
      echo "Stored in: " . "upload/" . $_FILES["file"]["name"];
      }
    }
  }
else
  {
  echo "Invalid file";
  }
?>

Saul · Accepted Answer · 2010-09-24 15:13:05Z

5

The user, that initially writes the files into your "/upload" directory, is the one that started the Apache instance running a PHP module.

In other words, PHP is the "owner" of all uploaded files and through a PHP script you can change the permissions of all relevant uploaded files without providing any credentials at all:

PHP chmod function

A quick and dirty hack to make uploaded files writable to all users would be

else 
      {
      move_uploaded_file($_FILES["file"]["tmp_name"], 
      $f="/home/user/mysite/upload/" . $_FILES["file"]["name"]); 
      chmod($f, 0777);
      echo "Stored in: " . "upload/" . $_FILES["file"]["name"]; 
      }

edited Sep 24, 2010 at 15:13

answered Sep 24, 2010 at 14:03

Saul

18k8 gold badges67 silver badges93 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

JB87 Over a year ago

thanks for the hack, but after trying it instead of getting full rights I get some very strange permissions? '-r----x--t 1 www-data www-data 0 2010-09-24 15:53 readme.txt'

Ibrahim Over a year ago

This because the file has sticky bit, which again comes with move_uploaded_files function.

JB87 Over a year ago

looks like there was a typo. in PHP the correct format is 'chmod($f,0777)'. leading zero was missing. this now works perfectly!!

Marc B Over a year ago

As well, you can make the upload/ directory SETGID (mode 2xxx), which forces any new files within it to be created with the upload directory's group ownership.

Ibrahim · Accepted Answer · 2010-09-24 14:05:52Z

3

move_uploaded_file uses umask(600). Use copy($source, $dest) instead of move.

answered Sep 24, 2010 at 14:05

Ibrahim

1,2613 gold badges13 silver badges21 bronze badges

2 Comments

JB87 Over a year ago

thanks for the umask(600) info on move_uploaded_file, where can I quickly reference more info like this? on the PHP module rights in linux

Ibrahim Over a year ago

I checked it on my system by calling umask function before and after move_uploaded and copy function in a test php script.

Jeff Rupert · Accepted Answer · 2010-09-24 13:51:58Z

1

You can use chmod to change the file permissions.

To get the permissions of a file, use fileperms.

answered Sep 24, 2010 at 13:51

Jeff Rupert

4,8602 gold badges23 silver badges17 bronze badges

3 Comments

JB87 Over a year ago

thanks, but how can I use this permission output to solve the problem?

Jeff Rupert Over a year ago

After you've uploaded the file, you can use fileperms on the folder to get the permissions, then use chmod with the result of fileperms to set the permissions as you want.

JB87 Over a year ago

thanks for the tip, I could see how this could work for dynamic systems with multiple folders and users.

Collectives™ on Stack Overflow

PHP upload permission problem

3 Answers 3

4 Comments

2 Comments

3 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

4 Comments

2 Comments

3 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related