User Photo Upload via Site - Best Practices?

aaron_karp

I want my users to be able to upload photos, and I know how to code that part. But I'm not sure how to make them easily accessible to my scripts after. Here's the problem as I see it:

I have enough sense not to make any of my public_html directories writeable. Therefore when a file is uploaded, I figure it needs to go in a folder in the root that has php-writable permissions. But then my scripts have to reference it like: "../../photos/file.jpg" and it won't have an absolute address available by browser.

There's gotta be a good way to make publicly available photo uploads, right?

Weedpacket

Store the files outside the web root if you don't want people to request them directly (or at least use an .htaccess file to block requests).

Not sure what you mean by your scond paragraph, but whether they're accessible to your scripts or not (using a file path) has nothing to do with whether or not web clients can access them (using a URL).

aaron_karp

Well, I'm mostly concerned about security. Basically, users will be uploading photos, and I don't want to write them directly to anything inside /public_html/ because that would require setting the permissions to XX7 which would be dangerous, right?

But if they're in /photos/ instead, then how do I access them via an IMG tag inside the pubhtml directory?

aaron_karp

Oh yeah, I'm on a shared server; that's why I don't want to give the image directory upload permissions. That makes sense, right? I'm going off stuff I've read around. Would it be safe to upload directly to /public_html/images/ ? I thought it wasn't.

Jasp182

I wouldn't overdo the security thing, because in this case it sounds like you're going to have to hack the hell out of your upload procedure just to do something simple like uploading a file where it can be accessible to your users. You're never 100% safe, so you should be as careful as possible, but not at the expense of the functionality of your site.

aaron_karp

So you'd say it's acceptable to make the permissions on my /public_html/images folder something like 777 ?

Jasp182

aaron_karp wrote:
So you'd say it's acceptable to make the permissions on my /public_html/images folder something like 777 ?

nah, you wouldn't even have to go that far. make "apache" the owner of the folder and then give apache rwx access to it (755 would work, so that other users could open and read from the folder, but not write).

Now, I'm not the security expert, but that's what I would do.

aaron_karp

Works for me. Thanks. Anyone else, speak now or forever just hack into my site =)

aaron_karp

I'm gonna intentionally not mark this as resolved, for now, in case anyone else has any suggestions.