using php to work with images

sfullman

php on my server runs as nobody and I have root access. Here's the dilemma:

for a typical web account I host, the client has a username like cpm076 - and they can ftp in with this username and password. so, all the files they upload are going to be

-rw-r--r--  1 cpm076 cpm076 13924 Aug 27 16:34 admin.php
-rw-r--r--  1 cpm076 cpm076 12484 Oct  2 08:04 cart.php
-rw-r--r--  1 cpm076 cpm076 12384 Aug 27 15:21 company-information.php
-rw-r--r--  1 cpm076 cpm076 11223 Aug 27 16:34 config.php
-rw-r--r--  1 cpm076 cpm076 10015 Aug 27 15:21 contact_us.php

but, I want php to be able to upload images so I normally do these linux commands for the images folder

chgrp -R nobody images;  //nobody is now the group for all images
chmod -R g+rwx images; //nobody can now add, edit and delete files

The problem is, when nobody creates a file, nobody is also the OWNER of the file:

-rw-r--r--  1 nobody nobody  1320 Aug 20 10:18 techtown.jpg
-rw-r--r--  1 nobody nobody  1651 Sep  9 15:54 techtown.png
-rw-r--r--  1 nobody nobody  18153 Sep 24 10:50 web site.jpg
-rw-r--r--  1 nobody nobody  45294 Sep 24 10:50 web_ site.jpg

and that means that cpm076 can't modify them. Similarly any files cpm076 uploads, nobody can't modify them.

Any ways to solve this tug-of-war? I know it's a linux question but I've yet to get a tip for a workable solution on this. Many thanks!

ixalmida

I don't think PHP is going to solve your problems. It will likely suffer from the same issues unless you somehow give every web user access to the root account.

You could, however, use PHP to make sure the file is "safe" before uploading it. Then you could give full 'rwx' rights to everyone.

Some useful file checking:

// Is file over the 2 MB size limit?
if($_FILES["file"]["size"] > 2000000)

// Is file an executable?
if($_FILES["file"]["type"] == "application/octet-stream")

// Is there a file to upload?
if(file_exists($_FILES["file"]["tmp_name"]))

// Check for image file types only...
if($_FILES['file']['type'] !== 'image/pjpeg' &&
  $_FILES['file']['type'] !== 'image/gif' &&
  $_FILES['file']['type'] !== 'image/x-png')

sfullman

appreciate the input and some of those things are definitely used in my coding.

However, I use cpanel on my server - the control panel url is on port 2086:

http://if-i-told-you-id-kill-you.com:2086/?

and a web-based application like that runs my entire server - as NOBODY no less! Does anyone know how php could pull this off - if I knew this I could at least call some root calls to chmod or chgrp if necessary.

Thanks, I'm convinced it can be done 🙂