Deleting 'www' owned files problem

[Anon]

Currently I have a search engine script set in the root folder. When a search is conducted it automatically writes folders and files relating to the variables entered for the search.

Then if exactly the same search is entered again at a subsequent time, the script automatically fpassthru()the relevant file.

The problem I have is that when the script writes the folders and files, the owner is always "www", which leaves me without the usual access for deleting, changing perms etc etc.

As you can imagine the size of this stored data could well get out of hand, and I therefore wish to be able to periodically delete so of the folders and files.

I've considered putting chown() into the script but was advised this cause a serious security issue.

So somehow I need to be able to turn these files into my ownership without compromising security.

I was wondering if there was a way to do it via a .htaccess file.

Or

If it would be easy to create a script which would spider the huge number of files and folders and change all their ownerships at once.

I would guess there must be a simple solution, as I would have thought this problem could be quite common.

Here is the excert from the script which writes the folders and then the files (if its of any use!):

if(!file_exists($cachedirectory)) // check to see if the directory already exists
{
$directorypieces = explode("/", $cachedirectory); //break the directory path into pieces
foreach($directorypieces As $folder) //run through the pieces
{
$folder1 = "/" . $folder; //add each folder in order of appearance
$folder2 = $folder2 . $folder1;
$folder3 = "/home/chilli/chillisauce-www" . $folder2;
if(!file_exists($folder3)) //check to see if folder exists
{
mkdir($folder3, 0777); //create a folder if it doesn't
}

}

$fp = fopen($cachefilepath, "w"); //create and open the file
fwrite($fp, $Output); //Write output to the file and close
fclose($fp);

[[deleted]]

How would using chown() cause a security problem? 🙂

Anyway. If the user www is making them, the easiest way to remove the files is by letting uer www delete them.

You can use a simple timestamping technique to update the file's timestamp every time it is used.
That means the files that don't get used often automatically keep their old timestamp, and you can write a simple script that looks for old files every day, or every request.

[Anon]

I was told not to use chown(mypassword) within a script just in case it was thrown out if the script failed - anyway the comment put me off.

I see your idea of a time stamp - and had similar thought myself, but how could I make a script to spider through the 10,000's of folders looking for the files time stamps?

Ie for a search
book on old cars

creates the file index.htm in the folder
search/book/on/old/cars

So basically I need a script which I could set to run which spiders every folder branch and deletes files older than their last modified data.

I have not idea though how to start on such a spider script.

[[deleted]]

That is a possibility, but the only information displayed would be something like
chown user:group filename.

not terribly usefull to a hacker. :-)

Anyway, if you are talking about 10k+ files, you are talking database.
When you create a file, you also create an entry in the database, and you update the timestamps in the database.
When you want to clean up, all you have to do is query the database for records older than X days, and you get a nice list of files that you can feed into a delete statement.

[Anon]

Cheers - I'll look into it.