Question

I am working on a PHP based website. In the admin there is a section that checks a form field and based on the field looks for a folder on the server. This folder will be in a sub-directory. If it does not exist it needs to be created. After that, previously existing or not, PHP will write file to the folder.

These folders will hold images and PDF files that will be viewed and/or downloaded on the main site.

Here is an example directory structure: merchants/east/user123
In the above merchants and east would definitely exist and user123 may exist or otherwise be created.

Given that info my questions are about folder permissions.

• What should folders be set to for the best security.
• Should I open them up wider during operations then chmod them (in PHP) after I’m done to something more secure?
• What should upper level folders be set to?

Answer 1

770 would be a safe bet for the files. Setting it to that would disallow any public access. I would implement some sort of document delivery system in PHP. PHP will be able to access the non-public files and then send them to the user.

The upper level folders could be set to the same.

Update

As others have said, you can easily chmod them to 600 without any issues. That’s the more secure way of handling it (prevents other users on the system from accessing the files). It also omits “execute”, which isn’t needed for file reading anyway. It’s my personal practice to leave the extras in unless there’s a defined reason not to.