php script changes owner of files/folders, now users can't delete them. Help?

[ingram]

Maybe I don't have something setup right on my LAMP server, if so, hopefully somebody can help me figure out what is wrong.

When files are uploaded through ftp, the owner is set to ftpuser and group is www-data. Some php scripts (TFTgallery) modify the owner of the files and folders that were uploaded using ftp, which makes it where they can't delete the files/folders because they don't have permissions.

 

That is not to big of a deal because I can delete it through ssh, but my main question is why can the php script change ownership of files/folders? It seems like a security concern that this happened. The script changed the owner to www-data on the following, plus some sub-directories:

 

ls -al

drwxrwx--- 12 ftpuser  www-data  4096 2011-09-08 13:37 .

drwxr-x---  3 ftpuser  www-data  4096 2011-07-18 20:46 ..

-rw-r-----  1 ftpuser  www-data  578 2011-09-08 13:32 404.php

drwxrwx---  2 ftpuser  www-data  4096 2011-09-08 13:38 admin

drwxrwx---  2 www-data www-data  4096 2011-09-08 13:37 albums

-rw-r-----  1 ftpuser  www-data  6351 2011-09-08 13:32 archive.php

-rw-r-----  1 ftpuser  www-data 13310 2011-09-08 13:32 calendar.php

-rw-r-----  1 ftpuser  www-data  1493 2011-09-08 13:32 cart.php

-rw-r-----  1 ftpuser  www-data  1508 2011-09-08 13:32 CHANGES

-rw-r-----  1 ftpuser  www-data  7469 2011-09-08 13:32 config.inc

-rw-r-----  1 ftpuser  www-data    38 2011-09-08 13:32 .cvsignore

drwxrwx---  3 www-data www-data  4096 2011-09-08 13:52 data

-rw-r-----  1 ftpuser  www-data  9581 2011-09-08 13:32 exif.inc.php

drwxr-x---  2 ftpuser  www-data  4096 2011-09-08 13:32 font

-rw-r-----  1 ftpuser  www-data  1158 2011-09-08 13:32 footer.php

-rw-r-----  1 ftpuser  www-data 40722 2011-09-08 13:32 fpdf.php

-rw-r-----  1 ftpuser  www-data 44086 2011-09-08 13:32 functions.inc

-rw-r-----  1 ftpuser  www-data 10764 2011-09-08 13:32 gallery.php

-rw-r-----  1 ftpuser  www-data    87 2011-09-08 13:32 .htaccess

-rw-r-----  1 ftpuser  www-data  1615 2011-09-08 13:32 IDEAS

-rw-r-----  1 ftpuser  www-data  3994 2011-09-08 13:32 image.php

drwxr-x---  2 ftpuser  www-data  4096 2011-09-08 13:32 images

-rw-r-----  1 ftpuser  www-data  814 2011-09-08 13:32 index.php

-rw-r-----  1 ftpuser  www-data  2454 2011-09-08 13:32 INSTALL

-rw-r-----  1 ftpuser  www-data 25301 2011-09-08 13:32 install.php

drwxrwx---  2 ftpuser  www-data  4096 2011-09-08 13:32 language

drwxr-x---  5 ftpuser  www-data  4096 2011-09-08 13:32 lightbox2

-rw-rw----  1 www-data www-data  439 2011-09-08 13:37 local_config.inc

 

Can anybody help figure out what is wrong here?

 

Thanks