[RESOLVED] File Uploads

GrexP

This is another one where I look at 3 or 4 examples that are all nearly identical and show basic functionality. When I try to use the code I receive an error that is unclear to me as to why it fails.

I tried two different examples, but here is the one I'm currently using. I received the same error with both.

<form enctype="multipart/form-data" action="uploader.php" method="POST">
    <!-- MAX_FILE_SIZE must precede the file input field -->
    <input type="hidden" name="MAX_FILE_SIZE" value="30000" />
    <!-- Name of input element determines name in $_FILES array -->
    Send this file: <input name="userfile" type="file" />
    <input type="submit" value="Send File" />
</form>

Here is the upload code.

$uploaddir = 'uploads/';
$uploadfile = $uploaddir . basename($_FILES['userfile']['name']);

echo '<pre>';
if (move_uploaded_file($_FILES['userfile']['tmp_name'], $uploadfile)) {
    echo "File is valid, and was successfully uploaded.\n";
} else {
    echo "Possible file upload attack!\n";
}

echo 'Here is some more debugging info:';
print_r($_FILES);

print "</pre>";

Here is what I get...

Warning:  move_uploaded_file(uploads/ipap4p.jpg): failed to open stream: Permission denied in /usr/home/domain/public_html/www-sec/myfolder/uploader.php on line 28



Warning:  move_uploaded_file(): Unable to move '/tmp/php3QO4Ye' to 'uploads/ipap4p.jpg' in /usr/home/domain/public_html/www-sec/myfolder/uploader.php on line 28

Possible file upload attack!
Here is some more debugging info:Array
(
    [userfile] => Array
        (
            [name] => ipap4p.jpg
            [type] => image/jpeg
            [tmp_name] => /tmp/php3QO4Ye
            [error] => 0
            [size] => 7342
        )

)

It seems to be a permissions issue or it could be that the folder does not exist or I'm pointing at the wrong folder.

Where is the tmp folder that it uses?
What should the permissions be?

I have an uploads folder that is just below the root of where the page is. I have a tmp folder that is at the same level as 'public_html', 'public_ftp', and 'www'. Both my 'uploads' folder and the 'tmp' folder have permissions set at 7-7-7. I also tried adding an 'uploads' folder at the same level as 'tmp'. At one point I changed the code above to $uploaddir = './uploads/';

Greg

NogDog

Based on your description of where the uploads directory is located:

$uploaddir = $_SERVER['DOCUMENT_ROOT] . '/../uploads/';

GrexP

No, that didn't get it. Even when I explicitly put in the full path like....

/home/domain/public_html/www-sec/myfolder/uploads/

I still get the same error.

Greg

bradgrafelman

Is this 'uploads' folder writable by the user that your webserver is running under? If you have shell access, try CHMOD'ing the folder to 777, else if you're using an FTP client, set the permissions of the folder to Read, Write, and Execute for the three categories (Owner, Group, Everyone).

GrexP

bradgrafelman;10908838 wrote:
Is this 'uploads' folder writable by the user that your webserver is running under? If you have shell access, try CHMOD'ing the folder to 777, else if you're using an FTP client, set the permissions of the folder to Read, Write, and Execute for the three categories (Owner, Group, Everyone).

From cPanel I can check the permissions and they are set to 7-7-7 for the folder.

GrexP

I wonder if maybe the tmp folder is not set in PHP.INI. If I could find PHP.INI I would be able to check. Grrrr!

bradgrafelman

No need to find php.ini - just do a phpinfo().

Also, in your upload script, try adding the following:

echo "DEBUG: Permissions on uploads folder: " . fileperms($uploaddir);

Let us know what the output is.

EDIT: Also, by the looks of the error messages, PHP is storing temp files in /tmp/. Note that you can also create a 'tmp' folder in your home directory and tell PHP to store files there instead. Normally this isn't an issue if your host hasn't already configured the server this way, but I just thought I'd throw it out there as another suggestion to try.

GrexP

DEBUG: Permissions on uploads folder: 16877

bradgrafelman

There's your problem; that corresponds to an octal setting of 0755, meaning that only the Owner has write permissions and that Group/Everyone only have Read and Execute permissions.

I'm not sure if you were simply looking at the wrong directory in cPanel or what, but PHP doesn't lie, so the permissions of this uploads directory must be set to 755 presently. Perhaps try forcing a recursive chmod on this directory from cPanel? Otherwise, if you have shell access, go in and chmod the directory yourself.

GrexP

I'll be a son of a *****. In cPanel when I view the permissions for the folder it brings up a dialog with what I thought were the current permissions - everything was checked and at the bottom it said 7-7-7.

These are NOT the current permissions. This what the permissions will be set to if I click on the "Change Permissions" button. I thought it was displaying the current permissions and I could change them from there. It comes up with 7-7-7 no matter what the current permissions are.

What a waste of time. Thanks for you help. It works.

I guess that is why this is the Newbie forum.

bradgrafelman

Heh no problem. There should still be a way to view folder/file permissions in cPanel, though... next to the directory listing, did it perhaps say "drwxr-xr-x" ?

GrexP

Now that I look at it better, at the far right it does list permissions, but they are so close to the file size listings I just didn't notice that the folders had permissions listed there. The other folders are 755 and now my uploads folder is 777. I am a veteran Windows/SQLServer database programmer first and foremost. The whole world of web based PHP/MySQLServer is very new to me.

Thanks again for sticking with me on this.