Upload file permissions problem

[Tony B]

I've moved an existing site (which I didn't write) from a apache/php/mysql
host under windows to a linux apache/php/mysql host.
I've sorted out most problems except one.
There is an upload function on the site, which uploads files via POST to
temp folder and then moves it into a folder on the host using php function
move_uploaded_f ile. Under windows this works fine but on the linux host the
uploaded file is created with 600 permissions so it cannot be accessed later
by site visitors. The folder it is uploaded into has 755 permissions. Is
there a way of setting the default file permissions so each uploaded file
can be set to say 644 or do I need to chmod each file after upload ?
Thanks

[Willem Bogaerts]

... There is an upload function on the site, which uploads files via POST to

temp folder and then moves it into a folder on the host using php function
move_uploaded_f ile. Under windows this works fine but on the linux host the
uploaded file is created with 600 permissions so it cannot be accessed later
by site visitors.

Do you serve your temp folder then?

The folder it is uploaded into has 755 permissions. Is
there a way of setting the default file permissions so each uploaded file
can be set to say 644 or do I need to chmod each file after upload ?

Let me see where things go wrong. As far as I know, there is one Linux
user (let's call this account "webserver" , although it has probably
another name) who does the upload to the temp folder and does all file
operations in PHP. So, theoretically, you could deny all "group" and
"other" rights on uploaded files.

Do the uploaded files show up in the temp folder? (Note that this is
hard to see, as PHP removes them if they are not processed) In general,
does the "webserver" user have enough rights on the temp folder?

Best regards,
--
Willem Bogaerts

Application smith
Kratz B.V.
http://www.kratz.nl/

[Tony B]

"Willem Bogaerts" <w.********@kra tz.maardanzonde rditstuk.nlwrot e in
message news:46******** *************@n ews.xs4all.nl.. .

>... There is an upload function on the site, which uploads files via POST
to
temp folder and then moves it into a folder on the host using php
function
move_uploaded_ file. Under windows this works fine but on the linux host
the
uploaded file is created with 600 permissions so it cannot be accessed
later
by site visitors.

Do you serve your temp folder then?

Not sure what this means ?

>The folder it is uploaded into has 755 permissions. Is
there a way of setting the default file permissions so each uploaded file
can be set to say 644 or do I need to chmod each file after upload ?

Let me see where things go wrong. As far as I know, there is one Linux
user (let's call this account "webserver" , although it has probably
another name) who does the upload to the temp folder and does all file
operations in PHP. So, theoretically, you could deny all "group" and
"other" rights on uploaded files.
Do the uploaded files show up in the temp folder? (Note that this is
hard to see, as PHP removes them if they are not processed) In general,
does the "webserver" user have enough rights on the temp folder?

I can't see as it disappears once the upload is complete.
However the file is uploaded ok except it ends up in the destination folder
with a 0600 permission. So for this to happen the php upload process user
must have write permission to whatever tmp folder is used and the
destination folder. I can chmod the file after is is moved into the
destination folder via move_uploaded_f ile(), but I'm trying to understand
why the uploaded file permission ends up at 0600 ?
Regards
Tony

[Jerry Stuckle]

Tony B wrote:

"Willem Bogaerts" <w.********@kra tz.maardanzonde rditstuk.nlwrot e in
message news:46******** *************@n ews.xs4all.nl.. .

>>... There is an upload function on the site, which uploads files via POST
to
temp folder and then moves it into a folder on the host using php
function
move_uploaded _file. Under windows this works fine but on the linux host
the
uploaded file is created with 600 permissions so it cannot be accessed
later
by site visitors.

Do you serve your temp folder then?

Not sure what this means ?

>>The folder it is uploaded into has 755 permissions. Is
there a way of setting the default file permissions so each uploaded file
can be set to say 644 or do I need to chmod each file after upload ?

Let me see where things go wrong. As far as I know, there is one Linux
user (let's call this account "webserver" , although it has probably
another name) who does the upload to the temp folder and does all file
operations in PHP. So, theoretically, you could deny all "group" and
"other" rights on uploaded files.
Do the uploaded files show up in the temp folder? (Note that this is
hard to see, as PHP removes them if they are not processed) In general,
does the "webserver" user have enough rights on the temp folder?

I can't see as it disappears once the upload is complete.
However the file is uploaded ok except it ends up in the destination folder
with a 0600 permission. So for this to happen the php upload process user
must have write permission to whatever tmp folder is used and the
destination folder. I can chmod the file after is is moved into the
destination folder via move_uploaded_f ile(), but I'm trying to understand
why the uploaded file permission ends up at 0600 ?
Regards
Tony

Tony,

Try a linux admin group. The default file mask for your apache user is
probably set up as 600.

--
=============== ===
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
js*******@attgl obal.net
=============== ===

[Willem Bogaerts]

... I can chmod the file after is is moved into the

destination folder via move_uploaded_f ile(), but I'm trying to understand
why the uploaded file permission ends up at 0600 ?

Ok, I thought that you could not upload at all due to rights problems.
But I still cannot see the problem. The "upload generator" and the "web
server" are still the same user as far as I know, so this user should be
able to read (and serve) the 0600 files just fine.
As Jerry Pointed out, you can set the default umask in apache. Note that
this is a negative mask, so you have to set the bits that you want
cleared in the file permissions.

Best regards,
--
Willem Bogaerts

Application smith
Kratz B.V.
http://www.kratz.nl/