Re: safe_mode on and upload file

On Wed, 6 Oct 1999, Fabien Penso wrote: > Hi, > > I had no answer on any list, so I ask it here. > > I use the safe mode with PHP, and when I try to use uploadfile, it does > not work because the uploaded file in /tmp/ is owned by the same uid > that Apache use (www-data) and my script is owned by me (penso). > So basicly if I use the safe mode, I can't offer my users to use upload > file ? The only solution I found for now is to manually make their > scripts owned by www-data, but then I got a security hole. > > Also the error message I got is: > > PHP 3 Warning: SAFE MODE Restriction in effect. The script whose uid > is 1000 is not allowed to access /tmp/php30288aaa owned by uid 0 in > /opt/apache+php/htdocs/news/submit.phtml on line 137 > > As you see it tells me /tmp/php30288aaa is owned by 0 (root) which is > not right, it is owned by 33 (www-data). So the error message has an > error :) > > Please tell me if their is a solution for thoses upload files. Thanks ! Not really. Safe Mode and file uploads don't mix well. You'd have to run some sort of external setuid program to "fix" the permissions on the uploaded files before trying to manipulate them with PHP. -Rasmus