not able to upload images to a folder outside of root on a VM

[ajoo]

Hi all !

 

Below is the code on xampp that works great and stores images in a folder called uploads that lies outside of the root. 

	$valid_mimes = array("image/jpg", "image/jpeg", "image/gif", "image/png");
	if(in_array($mime, $valid_mimes)) 
	{
		$uploaddir = 'D:/xampp/php/internals/uploads/';
		$uploadfile = bin2hex(random_bytes(FILE_NAME_LENGHT));	
		$uploadfile = $uploaddir.$uploadfile.".tmp";		 	
	} else {
		$_SESSION['error'] = "Not a valid image file. Choose another";
		return false;
	}

As can be seen I have hardcoded the absolute path to the folder uploads. This works fine and there are no issues with it. But the corresponding code in VM always gives a 

 

 

[Fri Apr 07 12:43:47.108833 2017] [:error] [pid 2840] [client 192.168.2.6:54489] PHP

Warning:  imagepng (/vargant/www/franchisee.com/public/internals/uploads/0f99744c8ecbd5259c7555d3.tmp): failed to open stream: Permission denied in /vagrant/www/franchisee.com/public/internals/includes/fran_functions.php on line 158, referer: http://franchisee.com/index.php?page=franchisee

 

The code that produces this error on VM is as below

			$valid_mimes = array("image/jpg", "image/jpeg", "image/gif", "image/png");
			if(in_array($mime, $valid_mimes)) 
			{

			//	$uploaddir  = '/../uploads';
			//	$uploaddir1 = '/../internals/uploads/';
				$image_path = getenv("IMG_DIR");
				$uploadfile = bin2hex(random_bytes(FILE_NAME_LENGHT));	// substr(hash('sha512',rand()),0,12);	
				$uploadfile = $image_path.'/'.$uploadfile.".tmp";			//	$uploadfile = tempnam($uploaddir, "upm"); 	
			} else {
				$_SESSION['error'] = "Not a valid image file. Choose another";
				return false;
			}

and 

                            getenv("IMG_DIR");  returns the absolute path /vargant/www/franchisee.com/public/internals/uploads.

 

Again the environment variable contains the absolute path to the uploads folder but I keep getting the said error. 

 

I have tried with file permissions 640 and 660 for the uploaded files. I have tried with folder uploads permissions set 710 and 740. The permissions on folder internals and includes is 710.

 

The root folder is franchisee.

Internals is outside the root and on the same level as franchisee.

 

Public -- Franchisee -- index.php

           |                        |

           |                        --- Some folders under root

           |

          -- Internals ---- includes   |

                               |                      > folders outside of root

                             ---- uploads    |

 

Where am i going wrong ?

 

Thanks all ! 

 

[requinix]

1. Delete uploads directory. If you need the files in there then move the directory somewhere else. Point is, uploads/ is gone.

2. chmod 0777 the parent directory (internals/)

3. Use PHP to recreate uploads/ with normal 0755 permissions - through your web server, not a CLI script

mkdir("/vargant/www/franchisee.com/public/internals/uploads");

4. chmod the parent directory back to normal

5. If you had files from #1, put them back. Make sure everything is owned by the same user as uploads/ is, using normal permissions.

 

The result is that PHP can put files in uploads/ and you don't have to fiddle with permissions after the initial setup.

 

To answer the question, first acquaint yourself with Unix permissions. Couple your new-found knowledge with the likely fact that PHP is running as a different user from the one who owns the files and directories and you should come to the conclusion that the permissions you were trying wouldn't work.

[Jacques1]

We've already discussed this at great length, so when in doubt, just reread the thread.

 

The short version: Create an administrative account, make that the owner of the directory, make the webserver's group the owning group.

chown -R name-of-admin-user:name-of-www-group /path/to/uploads

The webserver obviously needs write permissions as well as the execute bit, so that's

chmod -R 730 /path/to/uploads

Note that I'm talking about the permissions in the VM, not the host machine. So you'll have to log into the VM and execute the commands there (or use whatever mechanism Vagrant offers).

[ajoo]

Hi requinix, 

 

Thanks loads for the reply. 

 

While I haven't tried your solution yet, reading and re-reading the Warning, it appears to me that maybe the problem lies with the permissions of the includes folder that contains the script which tries to write the uploaded file to a folder. I thought I would reconfirm with you once before I bark up the tree.  

 

And while I am at it, I would also like to ask what exactly you mean by the 4th point in your reply, namely,  chmod the parent directory back to normal ?

 

I have read the Unix permissions but I still can't figure out the rest.

 

Thanks loads

 

@Guru Jacques:

 

Hi Guru Jacques, 

 

Just saw your post !!

 

Actually I re-read the last thread on permissions quite a bit and that's the one I followed to reach till here and came up with some questions.  Will read and revert once again.

Edited April 8, 2017 by ajoo

[Jacques1]

Actually I re-read the last thread on permissions quite a bit and that's the one I followed [...]

 

Then I don't understand why you would make the upload directory read-only.

[ajoo]

Wow !! that worked the very first go !!!  , (the permission 730 - rest was all correct)

 

 

 

Then I don't understand why you would make the upload directory read-only.

 

         !! I wish I knew, I guess I am still confused and muddled regarding permissions. 

 

Thank you very much Guru Jacques ! 

Edited April 8, 2017 by ajoo