rainjam Posted March 17, 2007 Share Posted March 17, 2007 I'm transferring a CMS for a site (www.perfectskindirect.co.uk) from its current IIS home onto a dedicated Linux server. This has caused a couple of hiccups with file permissions and other stuff. The "add a new product" section works fine: it has an image upload function which takes an image and saves four square versions of it at different sizes, in different directories, named as the product's ID number and ".jpg" (eg 544.jpg). This works fine as long as there isn't already a file with that name. When you're editing an existing product, though, and you want to change the image, it won't let you do it, although it uses most of the same code. It seems to be creating new image files with the permissions -rw-r--r-- (which would be 644 I think?) The host (CWCS) has said: The files are created by the apache user, the php scripts can only modify the files if they are owned by the same user (apache) or root. Changing the ownership of the php scripts to apache or root presents a significant potential security risk and should be avoided for scripts. You may find what you are trying to achieve easier to do by uploading the files into a database. I don't really want to have to rewrite things so images are uploaded into the database, and don't really see why I should have to: surely there must be a way to set apache up (given that this is a dedi server and we can do what we want with it) to be able to write, edit and delete files within a given directory, but not accidentally mess around with files anywhere else? I'm not a Linux expert, so I'm unable to tell if this script is running as the right user, if it has the permissions to set permissions, or if I'm on the wrong track entirely.... At the moment, after you've tried to replace an image, if you browse directly to it you get a 403: Forbidden error. Thanks in advance Nick Quote Link to comment Share on other sites More sharing options...
steviewdr Posted March 17, 2007 Share Posted March 17, 2007 suPHP (which is on apt (advanced packaging tool) on debian linux) specifically is meant to overcome this issue with permissions. suPHP allows the php script to run as the owner of the file, thus when uploading files - they are owned by the main owner of the php upload script and can be 644. If you have a dedicated box - that would be the best way. The typical and easiest way is to chmod 777 all your upload directory and its current files so you can edit them. It all depends on how sensitive your data is and whether there are other users on the server. SImple fix = chmod 777 Proper fix = suPHP -steve Quote Link to comment Share on other sites More sharing options...
rainjam Posted March 19, 2007 Author Share Posted March 19, 2007 Thanks Steve. I've emailed the host to see if we can do that. Cheers Nick Quote Link to comment Share on other sites More sharing options...
steviewdr Posted March 20, 2007 Share Posted March 20, 2007 It'll be interesting to see what they reply with ;-) -steve Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.