Re: [PHP] File Upload Security and chmod

For whatever reason when I ftp in using WinFtp I don't see public_html
(it's hidden, don't know why; if I make a directory called
".public_html" it gets created and then disappears), but I can see my
file structure from my host's website and so I know that when I ftp in
to myDomain.com this is what is "there":

index.htm
page1.htm
page2.htm
..public_html/
images/
etc. etc.

Currently nothing is stored in my .public_html directory since it is
not my root (and my website loads just fine when browsed to).

I don't ftp in from DreamWeaver and it isn't an issue of going
straight to public_html just to skip the cd step. public_html just
isn't set up as my root directory and I have no directories accessable
that are higher than my root.

So, since I have no access to directories outside of my root, do you
really think I should change that before allowing file uploads?
(either by changing servers or just bugging my server adminstrator
until he changes it). I currently check extension type and then image
type using get_image_size(); and also files with image extensions are
not executable on the server. However, from what I've read I
understand that those steps are the minimum in terms of file upload
security.

Also, I'd be curious still to hear why I can browse to a file in a
directory that has been set with chmod 0100. I really didn't expect
that.

Thanks again very much for your thoughts,

Andy


On 9/22/06, Richard Lynch <ceo@xxxxxxxxx> wrote:


I may have hit "send" too soon...

Like, when you do FTP, do you see:

index.htm
page2.htm
page3.htm

right away?

*OR*, do you see:
public_html

And then you do "cd public_html" and THEN you see the files?

If you don't do "cd public_html" then I really don't think accepting
file uploads is a Good Idea, unless you have access to /tmp or
something to put the files in...

If you do "cd public_html" then you actually HAVE space outside your
webtree. Just do "mkdir uploads" and "chmod 777 uploads" *BEFORE* you
do "cd public_html" and you'll have an uploads dir outside the webtree
where you can put stuff.

NOTE:
Some fancy FTP tools like DreamWeaver and whatnot will convince you to
put "public_html" into some input box somewhere, to give you the
convenience of not needing to "cd public_html" -- which then means you
never *SEE* that you have space outside your webtree... Stop doing
that. An extra click or whatever to get into public_html is not that
big of a deal.

On Fri, September 22, 2006 7:21 pm, Andy Hultgren wrote:
> So pretty much there's nothing to be done about it? If I can get the
> chmod thing to make it so that you can't surf to your uploaded image
> afterwards and view it, I'd be happy with that solution. I'd like to
> stick with this host if I could.
>
> On 9/22/06, Richard Lynch <ceo@xxxxxxxxx> wrote:
>> On Fri, September 22, 2006 3:58 pm, Andy Hultgren wrote:
>> > that as my root directory is simply www.myDomain.com and not
>> > ".public_html/" and I am on a shared server where my root cannot
>> be
>>
>> I got two words for you:
>>
>> Change Hosts
>>
>> --
>> Like Music?
>> http://l-i-e.com/artists.htm
>>
>>
>>
>
> --
> PHP General Mailing List (http://www.php.net/)
> To unsubscribe, visit: http://www.php.net/unsub.php
>
>


--
Like Music?
http://l-i-e.com/artists.htm



.

Relevant Pages

  • Re: FTP Replication SQL Server 2005
    ... set up the snapshot directory or the alternate snapshot directory to map to ... the physical root or a subdirectory in your ftp server, ...
    (microsoft.public.sqlserver.replication)
  • Re: ftp to webserver - not as root
    ... >> I'm learning to set up a server via remote. ... We set it up so that root cannot ftp or ssh in. ...
    (Debian-User)
  • Re: ftp with user root
    ... consider not using an unsafe method like ftp to get the file from A to B. ... the root entry. ... placing files from a client to server. ... > How can I enable ftpd to permit the user root? ...
    (freebsd-questions)
  • Re: Mandrake 8.1 Desktop Gone
    ... You want to set up anonymous ftp with a chroot jail. ... Use chmod to remove "others" access to all directories in root. ... database using the same package specification ...
    (alt.os.linux)
  • Re: root access denied via SSH
    ... After adding this user and modifying it to have root ... When you say users have lost access only via ssh, ... for FTP access and never SSH access. ...
    (comp.unix.questions)