473,574 Members | 2,700 Online
Bytes | Software Development & Data Engineering Community
+ Post

Home Posts Topics Members FAQ

Safe Mode & File Upload

Hi!

Is there any solution to create a directory with one script
with mkdir(), and then write a file (or move an uploaded file) in this
directory with another script?

The problem is, that the directory belongs to the PHP-interpreter (UID
33 in my case) and the script doing the file creation and the one
creating the directory belong to the FTP-user (UID 754 in my case).

I just can't create diffenent directories and write some pictures in.

My provider doesn't want to turn off Safe Mode.

thanks
Dave
Jul 17 '05 #1
4 3646
Carved in mystic runes upon the very living rock, the last words of pdav
of comp.lang.php make plain:
The problem is, that the directory belongs to the PHP-interpreter (UID
33 in my case) and the script doing the file creation and the one
creating the directory belong to the FTP-user (UID 754 in my case).

I just can't create diffenent directories and write some pictures in.

My provider doesn't want to turn off Safe Mode.


You could create the directory with open permissions. But your provider
should install a script wrapper. This is much more secure than files and
directories with open permissions.

Or you could move to a better provider.

--
Alan Little
Phorm PHP Form Processor
http://www.phorm.com/
Jul 17 '05 #2
Alan Little schrieb:
You could create the directory with open permissions. But your provider
should install a script wrapper. This is much more secure than files and
directories with open permissions.


What do you mean with open permissions?
Something like mkdir($dir, 0777) or so?
This doesn't work, mkdir creates directories only with permission 0755
on this server. And chmod($dir, 0777) doesn't change the ownership.
chown() is not allowed at all (because the directory doesn't belong to
the script, it belongs to the PHP-interpreter).

Thanks anyway

Dave
Jul 17 '05 #3
Carved in mystic runes upon the very living rock, the last words of
David Prem of comp.lang.php make plain:
Alan Little schrieb:
You could create the directory with open permissions. But your
provider should install a script wrapper. This is much more secure
than files and directories with open permissions.


What do you mean with open permissions?
Something like mkdir($dir, 0777) or so?
This doesn't work, mkdir creates directories only with permission 0755
on this server. And chmod($dir, 0777) doesn't change the ownership.
chown() is not allowed at all (because the directory doesn't belong to
the script, it belongs to the PHP-interpreter).


No, chmod doesn't change the ownership, but allows anyone to access it,
so that it doesn't matter who owns it. Very insecure.

--
Alan Little
Phorm PHP Form Processor
http://www.phorm.com/
Jul 17 '05 #4
Alan Little schrieb:
No, chmod doesn't change the ownership, but allows anyone to access it,
so that it doesn't matter who owns it. Very insecure.


I know, it shouldn't do.
But if I create a directory with mkdir($dir, 0777), there is a directory
with permissions 0755 and I can create files with a Script owned by the
FTP-User.
If I create the same directory, but use chmod($dir, 0777) after
creation, the directory gets permissions 0777, but I can't anymore
access the directory with a Script owned by the FTP-User because
SafeMode says, that the directory belongs to the PHP-Interpreter.
I know that chmod() doesn't change the owner, but why then it works
without chmod() but doesn't work with chmod(0777), although 0777 gives
me more permissions than standard 0755.

Thats the big problem and that's why I don't understand how ownerships
are determined.

I know:
File-Upload via FTP -> Owner: FTP-User
File-Creation via PHP -> Owner: PHP-Interpreter

Directory-Creation via PHP -> Owner: should be PHP-Interpreter, but no
Problem with SafeMode although I create Files with Script owned by
FTP-User in Directory owned by PHP-Interpreter.

Directory-Creation via PHP and Permissions set by chmod() -> Owner:
definitely PHP-Interpreter, because then there is a problem for SafeMode.

I don't understand why it works without chmod()... There should also be
a problem.

And why can't I create a file in a Directory with permissions 0777 only
because it's not mine. Permissions 0777 do allow me write access,
although it isn't mine, am I right?

Why is there SafeMode, when I cannot work with it right?

Dave
Jul 17 '05 #5

This thread has been closed and replies have been disabled. Please start a new discussion.

Similar topics

2
2359
by: Paul Schmidinger | last post by:
Hi, I created a directory with PHP mkdir (mode 0777). Then I try to move_ulpoaded_file() to move a file into this directory. I get an error: Warning: move_uploaded_file(): SAFE MODE Restriction in effect. The script whose uid is 1999 is not allowed to access /home/www/ww4592/html/fs/PHP/Dateien/Bereich_1/NEUER_ORDNER owned by uid 33 in...
0
2950
by: BDKiii | last post by:
Ok.. I know this has been covered before -but- here it is again... I installed Jmail to my server and tested it... and it worked fine. I then installed W#.Upload to the same server and tested it to attach a document or image file from a users PC and attach it to the email on the fly. I used the following 3 files to do this (attach1.htm,...
5
4969
by: Kelli | last post by:
Hi there, I'm wondering if someone can have a quick look at my code and see if there's anything that I've done wrong. This silly script is driving me crazy! <% DIM File, Upload, Count, Ext DIM Mail, strMsgHeader
14
5916
by: Arne | last post by:
A lot of Firefox users I know, says they have problems with validation where the ampersand sign has to be written as &amp; to be valid. I don't have Firefox my self and don't wont to install it only because of this, so I hope some of you gurus can enlighten me with this :) In what circumstances can the "&amp;" in the source code be involuntary...
3
4749
by: Rik | last post by:
Hello, first of all, my provider sucks, newsserver is down for the #nth time now, offcourse when I have an urgent question.... So this will be me first time using Google Groups, forgive me if something goes wrong. The problem at hand: In a restricted area I let a user upload an image, no problem The image gets scaled down with...
0
1309
by: falk0815 | last post by:
Hello, I have a php-enabled vhost in the apache2 configuration file. In the document root there are only html-files. So no php parsed file is called when the domain is viewed in a browser. But sometimes I get a warning notice about safe mode restrictions: Warning: Unknown(): SAFE MODE Restriction in effect. The script whose uid/gid is...
5
3309
by: rdlowrey | last post by:
Hi, I'm pulling my hair out trying to make this work and any help would be appreciated ... When I try to move the uploaded file: move_uploaded_file($_FILES,"/var/www/vhosts/ mydomain.com/intranet/httpdocs/lib/slips/in/$filename.pdf"); I get the following error: Warning: move_uploaded_file(): SAFE MODE Restriction in effect. The script...
7
242
by: bvdp | last post by:
I'm finding my quest for a safe eval() quite frustrating :) Any comments on this: Just forget about getting python to do this and, instead, grab my set of values (from a user supplied text file) and call an external program like 'bc' to do the dirty work. I think that this would avoid someone from embedding os.system("rm ...") in what I...
1
4871
by: chennaibala | last post by:
can any one send me mutiple image upload program and save the file name with extension in mysql table.we must cheak uploaded file type like bmp or any image file while uploading. i develop program,which can upload many file in folder.problem is,am unable to save my file name in to database.because i used same name for all input file type as...
0
7736
by: Hystou | last post by:
Most computers default to English, but sometimes we require a different language, especially when relocating. Forgot to request a specific language before your computer shipped? No problem! You can effortlessly switch the default language on Windows 10 without reinstalling. I'll walk you through it. First, let's disable language...
1
7826
by: Hystou | last post by:
Overview: Windows 11 and 10 have less user interface control over operating system update behaviour than previous versions of Windows. In Windows 11 and 10, there is no way to turn off the Windows Update option using the Control Panel or Settings app; it automatically checks for updates and installs any it finds, whether you like it or not. For...
0
8106
tracyyun
by: tracyyun | last post by:
Dear forum friends, With the development of smart home technology, a variety of wireless communication protocols have appeared on the market, such as Zigbee, Z-Wave, Wi-Fi, Bluetooth, etc. Each protocol has its own unique characteristics and advantages, but as a user who is planning to build a smart home system, I am a bit confused by the...
0
6461
agi2029
by: agi2029 | last post by:
Let's talk about the concept of autonomous AI software engineers and no-code agents. These AIs are designed to manage the entire lifecycle of a software development project—planning, coding, testing, and deployment—without human intervention. Imagine an AI that can take a project description, break it down, write the code, debug it, and then...
0
5305
by: conductexam | last post by:
I have .net C# application in which I am extracting data from word file and save it in database particularly. To store word all data as it is I am converting the whole word file firstly in HTML and then checking html paragraph one by one. At the time of converting from word file to html my equations which are in the word document file was convert...
0
3743
by: TSSRALBI | last post by:
Hello I'm a network technician in training and I need your help. I am currently learning how to create and manage the different types of VPNs and I have a question about LAN-to-LAN VPNs. The last exercise I practiced was to create a LAN-to-LAN VPN between two Pfsense firewalls, by using IPSEC protocols. I succeeded, with both firewalls in...
0
3755
by: adsilva | last post by:
A Windows Forms form does not have the event Unload, like VB6. What one acts like?
1
1350
muto222
by: muto222 | last post by:
How can i add a mobile payment intergratation into php mysql website.
0
1066
bsmnconsultancy
by: bsmnconsultancy | last post by:
In today's digital era, a well-designed website is crucial for businesses looking to succeed. Whether you're a small business owner or a large corporation in Toronto, having a strong online presence can significantly impact your brand's success. BSMN Consultancy, a leader in Website Development in Toronto offers valuable insights into creating...

By using Bytes.com and it's services, you agree to our Privacy Policy and Terms of Use.

To disable or enable advertisements and analytics tracking please visit the manage ads & tracking page.