Apache alias problems.

driven

PHP 4.0.6 and Apache 1.3.20
I'm using a password authentication scheme where I read from a password file through an Alias in Apache httpd.conf:
Alias /passwd /etc/apache/passwd

$data = file("http://myserver/passwd/users");
foreach ($data as $line){
print("<br>$line");
}

This works fine.

However, when I try to write to the file:
$fp = fopen("/passwd/users","a");
$bytes = fwrite($fp,$entry);
print("<p> $bytes bytes written.");
if(fclose($fp))
echo("<br>File closed");
else
echo("<br>File close error");

... it tells me that 23 bytes were written, $fp = file resource #1, and the file closed properly.
The problem is that the "users" file remains untouched.

Also:
I get no php errors.
The 'passwd' directory and the 'users' file have write access.
* php.ini:"allow_url_fopen = On

Thanks for any suggestions.

eoghain

The problem is that when you are using file() you are giving it an HTTP address which functions through apache and works with your aliases. But when you use fopen() you aren't using apache but the file system to navigate and the file /passwd/users is different from the file /etc/apache/passwd/users which is the one you are trying to manipulate.

If you look you will probably find a directory called /passwd and a file in that directory called users that has your changes.

driven

I appreciate your insight, but it still doesn't solve the problem of how to write to a text file that's outside of the web server's directory tree. Do you know of an elegant way to do this? I'm just trying to provide a way for users to set up a password through an online form.

Also, if file() uses Apache, and fopen() uses the linux file system, is there any way to tell which functions will use which?

thanks,

Lawrence

jwalk76

think of it like this. if an absolute path is used within a php script it must be called starting from </> i.e. </etc/apache/passwd/users>:

$data = file("/etc/apache/passwd/users");

if a path is echoed and then ouput as HTML, it is absolute starting from your DocumentRoot. in this case, PHP is used to generate HTML which is then parsed by Apache. if you had an image in /etc/apache/passwd/, then it would be valid to link to this image like this:

<img src="/passwd/image.jpg">

to sum up, aliased directories mean nothing to PHP, as eoghain said, so always use linux filesystem paths unless you are echoing output as HTML. i hope this clears things up.

eoghain

Exactly, I guess I wasn't clear on the solution. jwalk76 is completely correct, use a full system path to write the files. PHP is being run on the system and isn't constrained by the Web servers document root.

driven

Thanks, I think this clears things up.

I think my misunderstanding came from not being clear about what code (if any was exposed to the web user). Since php is server side, all a web user can see it the html output sent to the browser, so exposing an absolute file path within the script is not a problem (the user can't get to it anyway.)

eoghain

Not completely true. If for some reason your Apache server gets misconfigured then there is a chance that it will just display the php code to the user.

If you are really paranoid about it, just put your code to write the file into a function and place that file outside the Document Root and include() it into your scripts that need it. This way a user won't be able to see what is in that function if for some reason Apache decides to just show them the text of your script.