File Upload -> Permission denied

Anon

Hi folks,

I have the same problem like Elizabeth Alderton some days before. When I want to upload a file using

copy($file,$name)

the servers answer is :

Unable to create 'datei.tmp': Permission denied in /home/sites/site7/web/IMN/upload.php3 on line 6.

Question : HOW I can change the permissions on the server so that files can be uploaded. I would like to save them in a directory named /pics.

Thanks

cvincent

The destination folder that you are copying the file to must have write permissions for the user that is running the script. Type "ps aux" and see what user is running the web server and give write permission on the destination folder for that user.

-Chris

Anon

I am having the same problem
on the /tmp directory the permissions are
drwxrwxr-t
should this not be
drwxrwxr-x
also how do you use the chmod command to make changes on a directory . My main problem is that the service provider keeps telling me there is a problem with my script of which i don't think there is
i am using
html file -upload_form.html

<HEAD>
<TITLE>Upload a File</TITLE>
</HEAD>
<BODY>

<H1>Upload a File</H1>

</BODY>

and do_upload.php3
<?php
/ Userland test for uploaded file. /
function is_uploaded_file($filename) {
if (!$tmp_file = get_cfg_var('upload_tmp_dir')) {
$tmp_file = dirname(tempnam('', ''));
}
$tmp_file .= '/' . basename($filename);
/ User might have trailing slash in php.ini... /
return (ereg_replace('/+', '/', $tmp_file) == $filename);
}

if (is_uploaded_file($userfile)) {
copy($userfile, '/home/sites/site130/web/download/'.$userfile_name);
} else {
echo "Possible file upload attack: filename '$userfile'.";
}
?>
Am i doing something wrong ?

Anon

Check that the file isn't there before

Anon

It was an ownership problem i fixed the problem by using chmod o=rwx .
Is this dangerous as regards Security ?
thanks

Anon

I am having same problem could you tell me how u fixed it in more detail please.

Anon

assuming you have the correct access you can do the following
say your default web directory is "/web" and you want to allow uploads into the "/web/images"directory
from the command line in the web directory type
chmod o=rwx images
your command line might look like this
[web]$ chmod o=rwx images

thats it - i don't know if there is an security implications for this if you our anybody know please e-mail me

Anon

i have a problem like that too. for uploading files i have to chmod my pic directory to 777. But i didn't. because its so unsecure to do that. it means everyone can write everything there.. Also delete everything.. Also to fill that directory...

write me your opinion... :-)

Anon

Have you tried CHMOD 666, this worked on a server we were uploading to not long since, because yes 777 is pretty unsecure and your ISP will probably end up changing it back anyway!

elsad

problem is:
i want to upload my files to my domain. but for uploading i must open write permission in that directory. it solves a problem but it's unsecure too. because now(no write protect), everyone can upload his files, delete files, modify files... thats the problem. and... my server admin dont let me use chmod command. so i'm mailing him which directory must be in which permissins. it means i cant change my directories permissions in php script every time my script works. :-(

how can i solve this problem? can i solve?

Anon

Elsad,
have you tried Paul's suggestion of chmod 666 , it seems a bit devilish to me (ha!,ha!) . The uploading script that i have is fine for the purpose of its use the script can only be run if an administrator is logged in . The way to do this is to give the upload directory a name with letters and number so that no one can guess it , then only allow admin users to use the script . when the file is uploaded move it into another directory .
If you have any other ideas i would like to hear of them .
Regards,
Garreth

Anon

that's really good idea... (letter and numbers) but ... how am i going to move them? i dont want to do moving manually...

thanks for idea..

Anon

you could use the move function see

http://www.php.net/manual/en/function.move-uploaded-file.php

not 100% sure of the function as i've never used it . What do you make of it ?
Regards,
Garreth

Anon

i used it.
it wants write permission too...
and its unsecure too (open write permission)
you said that i can name my directory random by letters and numbers for not guessing it...

but for showing that picture i must send the path to the browser ...

Anon

elsad,
if you want to allow users to upload a file to your site and the users don't know the directory that it is being uploaded to , assuming that you have set a maximum file size limit , where is the problem ? Also if you want you could limit the users that are allowed to use the script by adding userid's and passwords from a populated database .
What exactly are you worried about .
if it is the write permission on the move of the file after the upload you could execute a system command before and then after the move procedure .
Regards,
Garreth

Anon

im building a photo site. i have writen all php script to run. i wrote administrating scritp too. for uploading a file, for adding it to the tabel automatically... so on..

but it has some problems with uploading. my problem is..

for uploading photos to site i must have write permission to that directory. i have it. but not in script. i have it if im connecting with ftp. so my script erroring me "cant crate file. permission denied" thats first error.
second: i cant execute system command "chmod". because admin dont let me. i havent got a permission to execute this command. i mean i cant change my permissions. my site is in www.f2s.com thats second problem.
third: i cant connect to my ftp by scritp. "undefined function error".

have you got any idea? have i got any chance yet? :-)

Anon

elsad,
sent me the code you are trying to use for the ftp and i will try and run it on my site .When i get it working i'll send it back to you .
Regards,
Garry.

Anon

Does anyone know of a way to upload files via a form, from one server i.e http://www.mydomain.com to another server http://www.myotherdomain.com. The script seems to disagree with the http:// bit of the upload path.

Regards Paul

Anon

Richard ,
you telnet to the server and run it then

here is a copy of a message i previously wrote in this discussion .

thats it - i don't know if there is an security implications for this if you our anybody know please e-mail me

Anon

and this is my code...

<?php

require("functions.php");

$filename=nextfilename();
$path = sprintf("/www.mydomain.f2s.com/photo/%s.jpg",$filename);
$path2=sprintf("/www.mydomain.f2s.com/photo/m%s.jpg",$filename);

echo ("<br>$path<br>");
echo ("$path2<br>");
echo ("<body bgcolor=\"#FFFFFF\">");

$conn_id = ftp_connect("ftp.mydomain.f2s.com");

$login_result = ftp_login($conn_id, "username", "userpass");

if ((!$conn_id) || (!$login_result)) {
echo "Ftp connection has failed!";
echo "Attempted to connect to ftp_server for user username";
die;
exit;
} else {
echo "Connected to ftp_server, for user username";
}

$upload = ftp_put($conn_id, $path, $file, FTP_BINARY);
$upload2 = ftp_put($conn_id, $path2, $minifile, FTP_BINARY);

if ((!$upload)||(!$upload2)) {
echo "Ftp upload has failed!";
die;
exit;
} else {
echo "Uploaded source_file to ftp_server as destination_file";
}

ftp_quit($conn_id);

unlink ($file);
unlink ($minifile);
include ("submit.php");
?>