File Permissions ( Write / Execute ) Problems

Anon

I am facing some problems regarding file uploads,copying & permission settings for it

I am copying a file to a directory in which I dont want to give EXECUTE permission
ie give only READ & WRITE

If I make the directory permission as 777
using CHMOD I am able to copy the file but also I am able to excute the php script.
I dont want this cos this will lead to security problem

But now if I remove the EXECUTE permission
ie CHMOD 666 ( giving only READ & WRITE )
to that directory I am not able to copy the
file to that directory . It gives Permission Denied Error .

I am using APACHE on Linux.

Can u please help me out in this matter.
How to solve this problem

Its very Urgent.

Hemen

Anon

Copy the file to a directory that is not accessible by apache.

Execute priveleges don't mean squat on php files because they are not executed by the system, they are interpreted by the php/apache executable.

Anon

Thanks for ur reply but if I copy the file which is not accesible by apache then how will I view this file .
Actually its an email application.
Where I am storing the attachments to
a particular directory then the user can later on view it.
It might be a case if user view an attachments with .php extention then the result would be that the script would be executed & it would be dangerous for the system cos it might be some bad script deleting the files . so it just to prevent.
If the attahcment is a zip file then its no problem.

So as I want the link to the uploaded file it has to be in Apache right ? Else its not possible .

Is there anyway around seeing this situation.

Anon

As far as I understand it, if you did copy the files to a directory not accessible by Apache, you can still access it through your PHP scripts. You would have to write a PHP script to list the directory for the user, and when the user clicks on the file, you would call a PHP script to retrieve the file for the user from the 'locked' directory. I would probably do something like this...

<?
$safe = '/home/httpd/safe';

if($filename == "") {

list the files available with links like

$ME?filename=xxx

} else {

retrieve file from the safe by opening with fopen,

or something similar, and feed it to the browser

line by line.

}
?>

Please excuse the psuedo code, but this should give you an idea.