Question

I have checked out articles and tutorials.

I don’t know what to do about the security of my picture upload-folder.

It is pictures for classifieds which should be uploaded to the folder.

This is what I want:

 Anybody may upload images to the folder.
 The images will be moved to another folder, by another php-code later on (automatic).
 Only I may manually remove them, as well as another php file on the server which automatically empties the folder after x-days.

What should I do here?

The images are uploaded via a php-upload script.
This script checks to see if the extension of the file is actually a valid image-file.

When I try this:

   chmod 755 images

the images wont be uploaded.

But like this it works:

   chmod 777 images

But 777 is a security risk right?

Please give me detailed information…

The Q is, what to do to solve this problem, not info about what permissions there are etc etc…

Thanks

If you need more info let me know…

Answer 1

You have to make sure the upload folder is owned by apache or whoever user is as which the http server is started.

Alternatively you can use 775 owned by the UID who will be collecting the files and with as gid the group id as which the webserver is started.

There are of course variations on these themes.

As long as the webserver user or webserver group has permission to write in the folder, it will be fine for uploading.

There are all kind of cornercases, but then we’ll need more info about your setup.