PHP fails writing to text file?

[Gilles Ganault]

Hello

I'm stumped as to why PHP fails writing into a text file, with the
script being called through Apache:

==============
# pwd
/usr/local/www/data/
==============
# ll
-rwxr--r-- 1 root wheel 499 Jan 15 04:59 index.php
==============
# cat /usr/local/etc/apache/httpd.conf
User www
Group www
#BAD User root
#BAD Group wheel
==============
<?php
$fp = fopen("test.txt", "w");
fputs($fp,"First line\r\n");
fwrite($fp,"Second line\r\n");
fclose($fp);
?>
==============
http://localhost/
==============
# ll
-rwxr--r-- 1 root wheel 499 Jan 15 04:59 index.php
==============

What am I doing wrong? Is it some kind of security feature in Apache
or the OS that's preventing the script from writing the text file?

I've tried "chown www:www index.php", with no change.

Thank you.

[Gilles Ganault]

On Tue, 15 Jan 2008 05:12:57 +0100, Gilles Ganault <no****@nospam.com>
wrote:

>What am I doing wrong? Is it some kind of security feature in Apache
or the OS that's preventing the script from writing the text file?

Found what it was:

=======
# ll
drwxr-xrwx 2 root wheel 512 Jan 15 05:20 .

# chmod 757 ./.
=======

Now, index.php can write into Apache's htdocs/ but I doubt this is the
right solution. Does it mean that PHP scripts shouldn't write any file
into htdocs/ ?

Thanks.

[Daniel Ennis]

Gilles Ganault wrote:

On Tue, 15 Jan 2008 05:12:57 +0100, Gilles Ganault <no****@nospam.com>
wrote:

>What am I doing wrong? Is it some kind of security feature in Apache
or the OS that's preventing the script from writing the text file?

Found what it was:

=======
# ll
drwxr-xrwx 2 root wheel 512 Jan 15 05:20 .

# chmod 757 ./.
=======

Now, index.php can write into Apache's htdocs/ but I doubt this is the
right solution. Does it mean that PHP scripts shouldn't write any file
into htdocs/ ?

Thanks.

Well to your problem yes it is the solution. Your running PHP as an
apache module, which makes the script run as www.

that htdocs folder is not owned by www nor in same group, so you have to
have 'Other' Permissions with Write access (the 3rd digit thats a 7 =
all access for Other).

Now, if your in a dedicated hosting environment, this is fine, but can
be annoying when writing files.

If you plan on hosting anyone elses site, or if you just want a little
more security/ease of file permissions look into suPHP.

suPHP is nice because it allows the php process to run as the same group
as the user running it, in other words does not require anything but
Owner permissions for Writing.

You could also chown the directory your writing too also to allow
access, or touch test.txt, chown www:www test.txt , and chmod 0755 test.txt

That way the file is already created, and index.php has permission to
write to it.
--
Daniel Ennis
faNetworks.net - Quality Web Hosting and Ventrilo Services
System Administrator / Web Developer
PHP Developer for 6 years
da****@fanetworks.net

[Jerry Stuckle]

Gilles Ganault wrote:

On Tue, 15 Jan 2008 05:12:57 +0100, Gilles Ganault <no****@nospam.com>
wrote:

>What am I doing wrong? Is it some kind of security feature in Apache
or the OS that's preventing the script from writing the text file?

Found what it was:

=======
# ll
drwxr-xrwx 2 root wheel 512 Jan 15 05:20 .

# chmod 757 ./.
=======

Now, index.php can write into Apache's htdocs/ but I doubt this is the
right solution. Does it mean that PHP scripts shouldn't write any file
into htdocs/ ?

Thanks.

Well, it's not necessarily a good idea - it's too easy to upload
malicious scripts. But with proper controls, it is possible.

chmod 757 will work, but as you found, is dangerous. Safer would be to
make the Apache user the owner of the directory, or at least a member of
the group which owns the directory.

--
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
js*******@attglobal.net
==================

[Gilles Ganault]

On Tue, 15 Jan 2008 06:42:07 -0500, Jerry Stuckle
<js*******@attglobal.netwrote:

>chmod 757 will work, but as you found, is dangerous. Safer would be to
make the Apache user the owner of the directory, or at least a member of
the group which owns the directory.

Right, I'd rather do this:

cd /usr/local/www/data ; chown www:www ./.

Thanks also Daniel for suPHP. I'll take a look.