File Uploads

[r_ward_2002]

Hi,

I am trying to build a file upload script so that selected users can upload files. Originally i had a file upload script, and secured the file with .htaccess, however, i need to be able to allow all users to see the files that have been uploaded, but only allow a few people to do the uploading. looking at the php webite i quote:

With PHP's authentication and file manipulation functions, you have full control over who is allowed to upload and what is to be done with the file once it has been uploaded.

but how!! i cant figure it out - im pretty new to php so help or a script would be handy!!

many many thanks

richard

[devinemke]

store the upload script in a dir that is htaccess protected
store the uploaded files in a dir that is not htaccess protected

[r_ward_2002]

thanks - works great.

one other problem. here is the code i am using to upload the files with, it works perfectly and does everything that i need it to do. the only problem is, the file that is uploaded for some reason becomes owned by the server, therefore i cannot edit if necessary. do i need to do something different in my code to solve that or is it not possible?

many thanks

<?php

//copy the file into the relevant directory
$path = "/inet/www.avonvalley.fordingbridge.org/html/uploads/$type/$filename_name";

if ($filename_name != ""){
	copy("$filename", "$path")or 
	die("Couldn't copy file.");
} else {
    die("<center>No input file specified.<BR></center>");
}

//log the file in the text file for that directory
$log = "/inet/www.avonvalley.fordingbridge.org/html/uploads/$type/$type.txt";
$file_text = $filename_name."|".$text_input."\n";
$fp = fopen ($log, "a");

fwrite ($fp, $file_text); 
fclose ($fp);

//send email to admin
$adminemail = "[e-mail]";
$msg = "File Name: $filename_name\nFile Type: $type : $filename_type\nFile Destination: $path\nFile Size: $filename_size\nFile Data: $text_input\n";
$to = "$adminemail";
$subject = "$type has been uploaded";

mail($to, $subject, $msg);

//print message to user
print "<CENTER>";
print "<div align=center><b><u>Uploaded to $sitename </u></b>";
print "<table border=\"1\" width=\"90%\" id=\"table1\">";
print "	<tr>";
print "		<td>Name of File:</td>";
print "		<td>$filename_name</td>";
print "		<td>File Size:</td>";
print "		<td>$filename_size bytes</td>";
print "	</tr>";
print "	<tr>";
print "		<td>Type of File:</td>";
print "		<td>$filename_type</td>";
print "		<td>Into Folder</td>";
print "		<td>$type</td>";
print "	</tr>";
print "</table>";
print "	<b>Your file and Information has been uploaded and emailed to the Site Administrator.</b>";
print "<p><input type=\"button\" value=\"Close Window\" onClick=\"window.close()\"><BR></font></p>";
print "</CENTER></div>";

?>

[devinemke]

[man]chown[/man]
[man]chmod[/man]
[man]chgrp[/man]

[r_ward_2002]

if i own a directory, should i be able to chmod it?

also, as the file that gets uploaded becomes owned by the server, is that why i cant change it as its a higher user?

sorry to keep bothering you

many thanks

Richard

[sysera]

Typically the file will be owned by "nobody" after it's uploaded, because that's what PHP runs as, user nobody. If you also "chmod 777" the upload files after they are uploaded, you can avoid permissions problems later on. Since PHP will be running the chmod, it will have no problems.

This is something I do for some of my scripts to avoid permission problems via the command line.

-Sys

[r_ward_2002]

any chance of seeing your script, mine just refuses to work.

[r_ward_2002]

when using move_uploaded_file, does the destination need to be chmod 777 or can it be lesser (ie, so not open for all access)

[sysera]

This is my code ward. It chmods the file after it's uploaded and moved.

<?php

ini_set('post_max_size', '90M');
ini_set('upload_max_filesize', 90);
ini_set('max_input_time', 6000);
ini_set('max_execution_time', 6000);

?>


?>

<?php
$dest = $_POST['destination'];

if (!isset($dest)){

$dest = $_GET['destination'];

}

$final_path="$root$dest/$filename";

if (isset($dest)) {

if (!empty($_FILES['ourFile']['name'])) {

$saveDirectory = "$root$dest/";

}

$tempName = $_FILES['ourFile']['tmp_name'];

$fileName = $_FILES['ourFile']['name'];

$fileName = str_replace(' ', "_", $fileName);

$fileName = str_replace('%20', "_", $fileName);

if (move_uploaded_file($tempName, $saveDirectory . $fileName)) {


@chmod($saveDirectory . $fileName, 0777);




header("Location: $siteurl/files.php?mode=listing&path=$dest");

}
}

  ?>

 <DIV ALIGN="center"><form action="<?php echo "$files_filename?mode=upload"?>" method="post" enctype="multipart/form-data" name="upload">
      <b></b><br><BR>
      <input name="ourFile" type="file" size="75"><br><BR>
      <input name="submit" type="submit" value="Upload"> <b></b>

<input type="hidden" name="destination" value="<?php echo $dest;?>">

</form></DIV>