Solved

move_uploaded_file and ownership/permissions

Posted on 2006-07-19
2
971 Views
Last Modified: 2011-10-03
Hello.

The following comment was posted by jest3r: (http://ca.php.net/manual/en/function.move-uploaded-file.php#57959)

                  "It seems that move_uploaded_file use the GROUP permissions of the parent directory of the tmp
                  file location, whereas a simple "copy" uses the group of the apache process. This could create a
                  security nighmare if your tmp file location is owned by root:wheel"

I have run into this problem.  How can I get around it?  Is there another command, or a custom function that would do the trick?

 
0
Comment
Question by:hankknight
2 Comments
 
LVL 14

Assisted Solution

by:ThG
ThG earned 100 total points
ID: 17137827

no, that's not possible unless your system has screwed up permissions (like setgid /tmp directory?).

how can you assert that you have run into this problem?

you can get more information about what's going on this way:

var_dump(stat($_FILES['....']['tmp_name']));
0
 
LVL 9

Accepted Solution

by:
cristi_2112 earned 400 total points
ID: 17138250
The best solution is to make a habit of running a chmod command after each upload with the desired rights.
So after each:
move_uploaded_file($file['tmp_name'], $destination.'/'.$file['name']);

call:
chmod($destination . '/' . $file['name'], $permissions);
0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Things That Drive Us Nuts Have you noticed the use of the reCaptcha feature at EE and other web sites?  It wants you to read and retype something that looks like this.Insanity!  It's not EE's fault - that's just the way reCaptcha works.  But it is …
Password hashing is better than message digests or encryption, and you should be using it instead of message digests or encryption.  Find out why and how in this article, which supplements the original article on PHP Client Registration, Login, Logo…
Explain concepts important to validation of email addresses with regular expressions. Applies to most languages/tools that uses regular expressions. Consider email address RFCs: Look at HTML5 form input element (with type=email) regex pattern: T…
The viewer will learn how to count occurrences of each item in an array.

895 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now