I've lost my touch()

Davidc316

I have recently finished work on a non commercial website that allows bands to sign up and create their own profiles (perhaps leaving a photo and a few MP3s along the way).

Anyway, I launched the thing a few weeks ago and at first it was working pretty well. During the first week or so I had a handful of bands successfully coming on and building their own band profiles.

But within the past few days it has came to my attention that the sign up scripts have suddenly stopped working properly. The problem is that when the scripts attempt to use the touch() function (to create a new folder for the band), the folder is NOT created and I get a permission denied message.

This is a very frustrating problem and any help would be appreciated.

The site in question is www.topgig.com. Feel free to try the band sign up process to see for yourself how it doesn't work the way it should do.

Not only am I worried about what could be causing the problem, but I'm also worried that somebody has messed around with the server.

Thanks for your help!

PS- I've just thought of something else that might be relevant.... Some other scripts on the website have ALSO mysteriously stopped working properly. For example, the admin panel for the news section won't allow me to upload and delete pictures (for the news section) any more. Hmmmmmmmmmmmmmmm.......

OhLordy

Sounds like the permissions have changed, if you can telnet/ssh into the server and have a poke aroud, have a look. If the permissions have been changed on the directory in question check the timestamp and then contact your host to see if they made any changes. If you're hosting the site yourself and the permissions have changed it's probably going to be one of your scripts which is the culprit, by explicitly setting them or leaving a hole which allows them to be remotely set.
Without knowing the full details it's hard to tell. In a situation like this I would say the first thing to do is have a real good poke around.
HTH

Davidc316

I think you were right!

I have solved the problem by changing the folder permissions to 777. I still don't know how they must have changed in the first place, but I suppose I can worry about that another day.

The trouble is, I feel rather nervous at the thought of allowing ANYONE to read, write and execute all of my files (apparently that's what a Chmod of 777 does).

Does a 777 chmod pose a serious security risk or am I being paranoid?

OhLordy

It poses a serious risk to that directory but if that directory does not hold anything vitally important (ie of system importance) then the risk is not terrible. You could make things more secure by chow (change owner) to the user apache or php (I think it's apache, someone correct me if I'm wrong) runs under, for apache this is user:nobody, group nobody. So to set this you would use the command "chown nobody:nobody directory" then you can just hav it as 700 or something like that. You could even set the 7 lower because execute permissions would not be required (unless you have some processing script in there) here's a good file to bookmark on permissions.
HTH