File Manipulation - mantain .htacces user validation for file ownership management

mad4dweb

Hi, there ill appreciate your comments

I have a File Managment Script that always uploads the files as user www and does not uploaded as the user that the .htaccess validated.

My script uid is user39 and so is the directory
i have the .htaccess file requiring a password for user39

The validation pases ok but
- when i upload the file it does it as user www
- If the other files dont belong to user www it wont modify it
unless the directory has 777 permisions.
- Then when i create a new directory if it does not have 777
permisions it wont let me do nothing

I tried solving this by:
- Turning on safe_mode - Didnt work
- Changing the upload_tmp_dir in php.ini - Didnt work
- Using HTTP authentication in PHP - Didnt work
- Using Htaccess file - Didnt work
- I have set chown to www.www to all files in the directory when i access by ftp i cannot modify the files becasue they are owned by user39.

This last mentioned solution works excelent for the file manager since its working with user.group www.www and there is no need to ad 777 permisions.

but as you can see at the time i ftp it does not let me modify this files.

So what im looking forward is for a way that the validated user when uploads it sets the file its user name and can also modify any files that belong to that user

Regards

bpat1434

I had a similar problem like this not too long ago. I was working on an image upload script, and I could upload them, but couldn't work with them via FTP (delete, change owners, etc.). The way I worked around this was to use FTP to create the directories. Once the directories were created, I was able to manipulate the files.

The .htaccess I think is probably not necessary. I would use sessions to validate a user, and then just destroy the session when they leave, and make them login to upload the files. If you follow these steps, you will find that you can manipulate files via FTP if you need.

I would not use .htaccess, but would definately use sessions or cookies.

I'm not able to give you the FTP script I used, but it's basic PHP FTP functions that creates directories. Nothing special. If you need it, I can give it to you Monday night/Tuesday sometime.

~Brett

mad4dweb

Thanks for the reply !!!

Sounds good the solution, but thats what i would like to avoid the use of an FTP function. i have used it in the past and some times works others doesnt.

But lets with it a try and see how your function works.

By the way i found this interesting articles

This one talks about the use of the safe mode
http://ilia.ws/archives/18-PHPs-safe_mode-or-how-not-to-implement-security.html

and this about permisions
http://forums.devarticles.com/archive/t-9241/derictory-permissions-and-uploading-files

With this last one i have manged to upload the files and them do some basic stuff with them throuth the ftp like renaming it and deleting but not chmod.

Im insisting in this mater because i have used a CGI file manager that if you logon as a user it uploads the file with the ownership of the user who uploads its using the .httaccess validation.

Regards

mad4dweb

Looks there is a solution to my problem

PHPsuexec

http://www.cablan.net/cablan/What_is_PHPSuexec_.449.0.html

http://www.peregrinehw.com/downloads/apache/current/INSTALL-PHPSUEXEC