File And Directory Permissions

[freddy]

In my new website I am going to offer a password protected admin part on my webiste for some to create news and edit files. but those files/directories need to be accessible... Is it save to change permission to 777 or 666 on directories and files?

 

Is there maybe another way to change those permission from within the php script for example? In this case permission would be reset so that once the script ends they are non writable again...

 

Any ideas?

 

I found chmod(), this does what I want but when I try it, it says operation not permitted. On the phpBuilder forums they say I can't change this myself... Any chance someone encoutered this before?

[TCH-Sales]

I'd say the easier way to change the file permissions would be through CPanel's file manager or through your FTP Client.

 

As far as the FTP Clients go, it's diffrent in every program. You should have a setting somewhere for CHMODing. (try right clicking the file, or just searching for it through the documentation)

[twowheels]

I've wondered that myself... can SSH users on the same server navigate to another person's public_html directory and then see/modify the paths that have read/write/execute permissions set for "other"??

 

I had one PHP script that just would not run unless I set one directory to 777. I didn't like that, so I found another script.

[freddy]

I've wondered that myself... can SSH users on the same server navigate to another person's public_html directory and then see/modify the paths that have read/write/execute permissions set for "other"??

This could be why TCH (and others?) have it turned off? I'm not sure if it can be done or not. Basicly I think it would be saver if I leave permissions as they are and change them in the script when I need to create a file or write to a file and ofcourse change them back when the script is done... If I find out i'll let you know...

[freddy]

I have submitted a helpdesk ticket and this is the answer I got.

 

Hi,

 

The error you received shows that you are not the owner of the file/folder. PHP runs as the user "nobody", it does not run as your username. So if your file/folder is created by your username then it won't be able to change it.

 

The error I got was "operation not allowed" when trying to use chmod. Appearently from what I've read on the phpbuilder forum, a work around is to have all your files and directories, that you want to be edited by a phpscript, uploaded and created by your php script. This changes the ownership to "nobody" and therefor user can acces them through your script.

 

It does seem like it's a bit to much... how save is it to actually set your files and directories that you want to have edited to 777?

[TCH-JimE]

Hi,

 

If you mean "how safe" rather then "how save" its not very. Why? Because 777 allows anyone to read, write and edit the files, basically leaving it open to anyone. Not a good idea really at all!

 

Jim

[freddy]

Since there is basicly no other way of changing file owner or permissions how would you suggest implenting an option that lets trusted users submit news or edit files?

 

I could write something in php to upload my website but i'm geussing it's like reinventing the wheel? (I'm afraid in my case it will be shaped like a square)

[TCH-JimE]

Hi,

 

Hmmm, depends how the news is read by your website. You could have a php page which people upload and download and edit on there own machines.

 

Jim

[freddy]

All news is in directory's sorted by month (./news/May/), current month directory contents is added to an array, sorted by filename and then included into a php template page. I have everything working on my own server (XP, IIS) wich handles permissions very different from linux, apache obviously. I would REALLY like to have this working here as well...

 

I'm not a php wizard or anything, otherwise I could add everything in a database but i'd have to learn how to do that first