I'm trying to debug a strange file permission issue involving php, and have exhausted the obvious problems. Note that I'm not experienced with php, so it might be something dead-obvious.
I want the user to be able to create a folder and files via a web interface, and to be able to work with those files from a separate user account on the server for some backend work. The problem is that the created folders and files have no write or execute permissions for other users.
I don't have a lot of knowledge in this area, so my best hacky try was to see if explicitly passing 0777, even though it's the default, to the relevant mkdir fixed it. And also to every other mkdir call. And every chmod call.
As far as I can tell, the folder and files SHOULD be created with the right permissions. Does anyone know reasons the permissions might differ from what I naively expect?
if this is UNIX you need to check the UMASK for the web server user, if this is windows, it ignores the permissions.
http://us.php.net/umask
Related
If you have a website, and have different files doing different things, how should you chmod each file?
For example:
A CSS file which controls the layout of the HTML home page. How should I chmod that?
A JS file with functions that give interactivity to the website. How should I chmod that?
And a PHP file which communicates and changes the website's content from the server. How should I chmod that?
I understand how the chmod function works, but I don't understand what files you should chmod in what way. HELP! :D
You should give 750 to PHP file.
For CSS and JS file 644 would be sufficient.
All directories should have 755 permission and all files(php, js, html) should have 644 permission.
As long as the webserver (and all other relevant processes) can access and modify everything it needs to in order to function, you're fine. It needs to be able to read all files it tries to access, and write into directories that it wants to upload files.
I use comprehensive ACLs in order to manage that logically on shared hardware.
$ man setfacl
Unless you have a reason not to (such as multiple users editing files, or you are using webserver-generated directory listings), I always use 711 permissions on all directories. Apache is quite happy with this.
This stops local users from seeing what files you have in there (such as, say, notes, info or config files), and can offer some protection if other settings are misconfigured (+Indexes is turned on, say) or if you don't have the ability to change such settings.
Also, this setting follows the principle of setting minimum required access. (Your mileage may vary on some web apps which need directories to be explicitly readable, but I haven't come across this.)
I am developing a website which provides the option that clients can upload their PHP scripts to a specific directory on my server. I want to make sure that my system is secure, and thus I do not want people to be able to use those PHP scripts to edit or view files outside of the directory they are uploaded to. In other words, if there is a file at public_html/directory1/foo.php, it should only be able to edit and view files in public_html/directory1, and should not be able to edit or view files anywhere else on the system. Is there any way of doing this?
This is super dangerous. Technically there are ways to do this if you know your way around linux/windows user and group configuration, Apache configuration, and PHP configuration. You'll need to run Apache under a user with extremely specific permissions and configure PHP to forbid certain types of commands (most notably the exec/system commands, but there are a lot of other ones that are likely to get you in trouble).
I'd strongly suggest you try to figure out a way to avoid giving your users the right to upload files to a folder where they'll be evaluated by the server as PHP. There's just too many things that can go wrong, and too many settings that can be overlooked.
If you do decide to go this route, do a lot of reading on secure PHP configuration and Apache Privilege Separation.
Since PHP is a server side script, I belive you'll find it hard to properly secure your system. Having said that, you can limit those files by running the apache server by a user which have no access to other directories, check SElinux for more info. please note that it's really hard to do so, you might forget even one file which can be used later to hack the system.
A better way might be running these server on top of a VM, so that even if someone hijacks the VM, you could always shut it down and restore it's data.
I have some php scripts that need to move, create and delete files and folders. Unless I CHMOD the folders to 777 the php scripts die with errors about permissions. CHMOD'ing the folders to 777 fixes the problem, but after a lot of reading I'm still confused as to whether it's OK to do or not.
I've read that it can be dangerous on shared hosting, but my question is, is it safe to do on a VPS?
VPS or not it does not really matter. Chmod 777 means you are giving anyone (any user, incl. system daemons) all permissions possible (which includes read, write and execute) to given file or directory. if you are the only user on the machine, then it reduces the risk (still, if anyone break in, then he would still be able to mess using hacked daemon's user id). Additionally, if there're other user accounts on that VPS, setting 777 lets them put their content into files with said permission (or launch them). Will they do that - who knows. They might, just because they can due to 777. In general, rule of the thumb should be give as much permissions as really needed, and nothing beyond that.
Ok this might seems a bad idea or an obvious one. But let's imagine a CMS like PHPBB. And let's imagine you'd build one. I'd create just 1 file called PHPBB.install.php and running it it will create all folders and files needed with PHP. I mean, the user run it just once and every file and folder of the app is created via the PHP file.
Why to do this?
Well mostly because it's cleaner and you are pretty much sure it creates everything as you wish (obliviously checking everything about the server first). Also, having all the files backed-up inside a file you would be able to restore it very easily by deleting everything and reinstalling it running again PHPBB.install.php. Backing-up files like this will allow you to also prevent errors: How? When an error occurred in a file, this file is restored as it was and automatically re-run.
It would be too heavy!
The installation would happen only once and you'd be sure the user will not forget to place the files correctly. The error-preventing will worth the cause and it would also happen only once.
Now the questions:
Does this technique exists? If so, What's its name?
Why would you discourage it?
As others have said, an installer.
It requires the web server to have permission to write to the filesystem, and ends up having the files owned by the user the web server runs as. Even when one has the ability to change filesystem permissions, it's usually a longer process than just extracting an archive and having the initial setup verify permissions.
Does this technique exists? If so, What's its name?
I'd advise to read about __halt_compiler(). It allows you to mix PHP code with non-php data which is not parsed, so you may have PHP code ("installer") and binary data (e.g., compressed contents of all the files) in single PHP file.
1 - Yes, there is a single install file in PHPBB. You run through an online wizard defining your settings and then it installs automatically.
http://www.phpbb.com/support/documents.php?mode=install&version=3&sid=908f5766fc04868ccb985c1b1e6dee4b#quickinstall
2 - The only reason to discourage it would be if you want the user to understand exactly how the system works. Automatically installing it means the user has no need to understand the nitty gritty of it all - of course, many see this as a good thing.
Alright, so I have a problem. I need to create a folder to store compiled templates in php. I have an install script that tries to mkdir() an appropriate directory (compiled_templates).
Invariably it returns this warning.
Warning: mkdir() [function.mkdir]: Permission denied in /home/tchalvak/sites/quotesite/quotes/install.php on line 92
Running changing the mode of the folder that the compiled_template folder will be created within also errors out on the same permissions problem.
Is there no way to assure that you can create what amounts to a storage folder via php? You have to use an outside-php program just to ensure that a folder is created? How do other php developers deal with this issue?
Edit: This is an installable script, so the overall objective is to allow 10 different random people to install the script on their server. This is why "making sure that php has all these great necessary write permissions to the compiled_templates directory" isn't practical as a manual process, unfortunately.
Edit: Damn, same permission error when just trying to create a temp directory as well. Lame.
If it's a temporary directory, create the directory in the system temp dir.
mkdir(sys_get_temp_dir() . 'example');
The general approach though is to simply ensure the user PHP is run as (e.g. apache) has write permissions where necessary.
I agree with putting the dir in tmp. To answer the more general question about dealing with this in installer script in general... You should set the perms up on the web root before you run the script and also make sure the perms are correct on any dirs within your package. With that said i generally try to avoid web installers and instead write installers for the CLI version of php. Of course you need ssh access on the box to do that but for me at least its very rarely the case that i dont.
Normally we set up the system to have the appropriate permissions, if that isn't an option your script should fail with a nice descriptive error message and possible solution.
Since you mentioned that you want a temp folder maybe the tmpfile(), tempnam() and sys_get_temp_dir() functions may be useful for you.
If using the system temp directory won't suit you, I've seen creative installers that ask for FTP credentials, and then use FTP to create directories and set permissions.
This may, however, be a bit too clever for it's own good.