Question

I’m trying to use this Dagon Design PHP form to help a local non-profit publication enable their readers to submit photos. I’ve got the “mailer” part working — the notifications work fine — but the “saving a file to a folder” part isn’t functioning.

On the form page, the author says “the directory must have write permissions,” but I’m not sure “who” is writing to that folder — is this PHP script considered “Owner” when it saves something on my site? Or do I need to allow save permissions for Owner, Group and Others?

I’m not sure why the script isn’t saving the photos, but this seems like a good place to start. I’ve tried looking around on Stack for answers, but most questions seem to have to do with folder creation/permissions.

The page I’m clumsily trying to build is here, if that helps.

Answer 1

As Jon has said already, you don’t want to allow write access to everyone.

It’s also possible (depending on the hosting) that something like suEXEC is being employed – which will cause your PHP script to run as a user other than the webserver’s (as reported by Dunhamzzz).

Probably your best approach, in my opinion, is a script calling whoami:

passthru('whoami');

Or alternatively you could try:

var_dump(posix_getpwuid(posix_geteuid()));

Bear in mind, this does give system information away to the world – so delete the script once you’ve used it!

Then, as you’ve correctly asserted in your question, it’ll likely be the file permissions.

If you do have CLI access, you can update the permissions safely as so (first command gets the group)

id -n -g <username>
chmod 770 <directory>
chown <username>:<group> <directory>

(You may have to pre-pend “sudo” to the “chown” command above, or find other means to run it as “root”…, reply back if you get stuck.)

If you’ve not got access to run command-line, you’ll presumably be doing this via a (S)FTP client or the alike. I’m afraid the options get a little to broad at that point, you’ll have to figure it out (or reply back with the client you’re using!)

As always, YMMV.

Finally, bear in mind if this is your own code, people will at some point try uploading PHP scripts (or worse). If that directory is accessible via a public URL … you’re opening the hugest of security holes! (.htaccess, or non-document root locations are your friend.)