script security problem

jdavila28

Hi Guys,

I've been working on a massive chat program for a few months and it's just about finished. But I've come to realize a big flaw.

Everything in my program is stored in mysql and the script itself is a php and ajax combo. But here is my problem.

There are public rooms and private rooms. Room files are the only thing in my program that are stored in flat files (text files) everything else is in mysql. With some of the features I've done its 10x more convenient for me to keep the rooms in text file.

Problem: text files are in my web directory. For public rooms no biggie. But private rooms are actually not private as I realized I could easily just use a leacher program or http direct (unless i put an htaccess file to prevent direct browsing)

When I tried to move my text file system outside of my server root (have a dedicated box) I got an error about base dir permissions and not being allowed to access files outside of the working web directory.

Any ideas where I can tell my system its okay to use these files outside of my web root? PhP.ini? which configuration line would it be?

I'm also using Litespeed server instead of apache, and have XCACHE installed and enabled for op code caching.

or any other advice on how to secure the text files would be greatly appreciated so that I can keep the room files in text files.

Cheers

jdavila28

just noticed that my open base_dir is set to a particular setting. is this the reason potentially causing the permission problems when trying to open the file with my php script? Should I unset this setting all together? or set it to something?

safe mode is off...

jdavila28

after some tweaking ive discovered how to get my open_basedir to /home instead of /home/user/public_html as it was set to before.

also after some further tweaking ive been able to let the file FILE.txt be written to in /home/rooms/file.txt

however I had to chown the file first from root to the username of my domain name in the document room public_html.

do I need to give change ownership of the entire directory /home from root to my local domain username so that it can write/read all the files it wants from php?

is there any danger in changing ownership of /home from root to my document user , is it even possible?

jdavila28

ahhhhhh. i finally got it. all i needed to do was have my base_opendir set to the /home setting and then chown the "rooms" directory under /home/rooms to "user" rather than "root" and now it writes the files fine...

Thanks to myself for all the help.. lol.

guess sometimes you just have to keep on tweaking.