Re: SAFE MODE,fopen, and chmod



That's the way safe-mode works.

The files going into the users/ folder are created by the "apache" (webserver) user.

The script running is owned by your account (eg "sample").

Since the UID's aren't the same you can't do anything.

See http://www.php.net/features.safe-mode

You could ask the host if they can enable safe_mode_gid and make sure that your user and the apache user are in the same group but that's about all you can do apart from disabling safe-mode.

(there are no workarounds, that's just the way it works).

Joseph S. wrote:
Hi all,
Consider this case:
I have a free php hosting account (a LAMP host) with an account name
(also the name of my directory) 'sample'.
Under 'sample', I have php scripts which can create files and folders
programmatically. I have manually created a directory called 'users'
under 'sample' and have given it a chmod 777 successfully.
From my script in 'sample', say myscript.php, I can successfully create
any number of files inside sample/users/, say, sample/users/aaaaa.txt,
sample/users/bbbbb.css, etc. I can also create directories at runtime,
say, sample/users/mydir1, sample/users/mydir2 etc. and can also
successfully chmod each to 777 (all this from myscript.php).
The host is "running in SAFE MODE", where, it seems that for fopen,
mkdir and many other functions, a check is done for the UID of the
script-running process to be the same as the UID of each resource
concerned(mydir1, mydir2, aaaaa.txt etc) and only if the UIDs match, is
the function allowed to work successfully.

The problem is that while I can make all these directories(mydir1,
mydir2, etc) under sample/users and files aaaaa.txt and bbbbb.css under
sample/users, I cannot make files inside mydir1, mydir2 etc. _inspite_
of the fact that I can _successfully_(confirmed from independent
filemanager utility) chmod all these created directories to 777.

The message I get is something like: Warning fopen(): SAFE MODE
restriction, the script whose UID is 12878 is not allowed to access
sample/users/mydir3 owned by UID 99 in /path/to/script/myscript.php on
line 484.

This inspite of the fact that the newly created sample/users/mydir3 has
been successfully chmodded to 777 as is visible from the host's
filemanager utility!

The same script has in the prior lines created the directory
sample/users/mydir3  and many files like sample/users/ccccc.css,
sample/users/dddddd.css and so on, without a problem. Plus, not having
permissions on mydir3 is ruled out because the script just made it
itself and chmodded it to 777.

Any clues?

Thanks in advance,
Joseph S.

.



Relevant Pages

  • Re: internet proxy
    ... Is it possible to create separate shortcuts to IE - one with 'proxy server ... This script gets used when you enable the "Automatically ... connect to the host so no proxy would get used. ...
    (microsoft.public.windowsxp.general)
  • Re: How do I insert a cgi script into Publisher page?
    ... is not where I host my website. ... If your ISP supports cgi and has a form handling program then a form ... You must tell the server what e mail address you want the form results ... any where else you so desire or an auto redirect script with a delay. ...
    (microsoft.public.publisher.webdesign)
  • Re: Setting new date with offset in days
    ... run (or host) the script. ... WSH which can run both JScript and WScript. ... Isn't WScript the windows program ... It seems that JavaScript or JScript is best used in a web ...
    (comp.lang.javascript)
  • [Full-disclosure] SecurityReason : PHP 5.2.6 (error_log) safe_mode bypass
    ... SecurityReason Research ... PHP is an HTML-embedded scripting language. ... When we create some php script in /www/ and try call to: ... The script whose uid is 80 is not allowed to access /hack/ owned by uid ...
    (Full-Disclosure)
  • Re: [RFC/PATCH -v2] Add sysfs control to modify a users cpu share
    ... E.g. UID x gets added to the sysfs ... generates a uevent and a script then figures out the cpu_share and sets it. ... configfs seems to allow creation of directories from ... scheduling and I expect distros to support CONFIG_FAIR_CGROUP_SCHED instead ...
    (Linux-Kernel)