Re: file upload (permission problem)

On Mon, 7 Aug 2000, Mark Lo wrote: > Hi, > > As I know, the uploaded file in php is stored in /tmp directory, > then we have to write a script to copy it into the destinations. such > as if (!copy($userfile, "/home/pictue/$userfile_name")). Now, I am > having a permission problem, It is not allow to copy the file into > specific destinations because of permission is not allowed to do so. The directory you want to copy a file into needs to be writeable by the user that runs the web server. > Security Questions: My web server is running as user (nobody) > and group (nobody). So what user and group should I set for the > specific destinations. If I set the destination directory to use nobody > and group nobody, what security risk do I have to concern (assume the > origional is root). The directory doesn't necessarily need to be owned by user and group nobody. All you need is write access, somehow. I typically run Apache with a user which is in a group 'websites'. Then it doesn't matter who owns the files, so long as the websites group has proper access. I'm not sure what you mean by assuming the original is root. If you mean the original file (the one in /tmp), it will be owned by the user running the webserver (nobody, in your case), not root. Matt