download script

step

Hi all, I'm trying to figure out how to do the following.

From a webpage, I want to be able to download a file for backup on regular basis. Thing is, that this file is below the www-root and should remain there for security reasons. So basically what I need is to be able to download it, preferably through a form button but just a link would be fine as well. Any ideas how to go at this?

Second question: I've written a script with which I can edit that textfile from my browser. What I'd like to do is to have a button that onClick would have that file e-mailed to a specific e-mail adress.

Any tips would be welcome. I haven't been able to find anything similar on the net yet :S

Thanks.

Step

theeper

Your webserver should not have permission to serve pages below the web root. You should move the file into the web root to access them. My question is, why is it not in the web root if you wanna serve it?

step

Originally posted by theeper
Your webserver should not have permission to serve pages below the web root. You should move the file into the web root to access them. My question is, why is it not in the web root if you wanna serve it?

the webserver doesnt have that permission, however, the webserver does have the ability to copy such file from below the webroot and serve it from there at the point when you need it.

As to your question- it concerns a mailinglist which I do not want to have in the webroot itself. The download would be done from a login/pwd protected page.

step

theeper

You have a directory that your webserver can read from that is below your web doc root ?

If the webserver can read it, that means it has execute permission on the directory the file resides in. This is not safe.

step

Originally posted by theeper
You have a directory that your webserver can read from that is below your web doc root ?

If the webserver can read it, that means it has execute permission on the directory the file resides in. This is not safe.

The same way as CGI can read below www-root it can be done with PHP.... Correct me if I'm wrong, but this is not an uncommon thing.

step

theeper

Hmm, maybe normal for some people, but since I run
PHP as an apache mod, I would not dream of letting
the apache user below the web root. Reason being,
I don't want scripters to be able to write scripts that
can access files below the web root.

step

Originally posted by theeper
Hmm, maybe normal for some people, but since I run
PHP as an apache mod, I would not dream of letting
the apache user below the web root. Reason being,
I don't want scripters to be able to write scripts that
can access files below the web root.

well - if you don't know who you let on your server, I can imagine. On the other hand, I'm one of those people who have a virtual account on a server and I'm happy my webhosting partner is not a pain in the a$$ about these things and allows a lot 😉

theeper

I hear ya, but if PHP is an apache mod, beware that anything you can write a script to do, so can anyone else that has access to the system. So, if I have an account on that machine, I might write a script that serves your file as well, or possibly delete or overwrite it.

step

Originally posted by theeper
I hear ya, but if PHP is an apache mod, beware that anything you can write a script to do, so can anyone else that has access to the system. So, if I have an account on that machine, I might write a script that serves your file as well, or possibly delete or overwrite it.

Thanks - I'm aware of that. Though the server is set up so that one can not list the directories from shell or through ftp. (of course this could be done with a PHP script on its own as well...)

Let me put it this way, the chance of someone else on that server wanting to harm me (or anyone else for that matter) is considerably smaller than the chance of an outsider doing such thing. No server is ever 100% secure and so everyone goes with the most secure method possible for that specific configuration with the lowest probability of security breach.

On a sidenote - Some hosts don't even allow shell access, because they consider it too much of a risk. Personally, I rather take those risks rather than spending hours extra working inefficiently ;-) Along with good backups the risks are acceptable I'd think.

feldon23

How safe is this?

dbase_admin.php

<?php

$currentdir = getcwd();
$dirtofile = "/home/elvis/";
$filetoecho = "dbase.txt";

chdir($dirtofile);
require $filetoecho;
chdir($currentdir);

?>

.htaccess

AuthUserFile <homedir>/.htpasswd
AuthName EnterPassword
AuthType Basic

<Files *admin.php>
require user dbadmin
</Files>

.htpasswd

dbadmin:<uuencoded password>

step

Originally posted by feldon23
How safe is this?

dbase_admin.php

<?php

$currentdir = getcwd();
$dirtofile = "/home/elvis/";
$filetoecho = "dbase.txt";

chdir($dirtofile);
require $filetoecho;
chdir($currentdir);

?>

don't know, but all this does for me is to echo the content of that file.