[canhelie]

i'm writing a script that lets users upload files. However, based on some options they can choose, the file will be uploaded into different directories and so I need the script to create the directory and then upload the file. I already have that part working. The part I'm having trouble with is the ownership of the directories created and the file uploaded. For some reason the ownership is set to "nobody". Also, when I used the function mkdir(), i specified that i want the permissions to be +311, but it makes it 711 for some reason. ANyone have any ideas?

[blaw]

Hello,

Did you specify the mode like this?

Code:

mkdir($dir_name, 0311);

You need a prefix zero before '311'.

Also, regarding the chown(), you need to specify either user name or its uid, which means this user has to exist on your server. In addition, it has to be a superuser in order to use chown() to change the file owner to whom other than 'nobody' or 'Apache' or whatever the default is or you'll get an error message like "operation not permitted".

Hope this helps.

[canhelie]

hello, thanks for the reply. yes it does help. So if the script is not owned by a superuser, then there is no way of chowning a file or directory?

When I create a file or directory, how come the ownership is "nobody"? shouldnt the owner be the same as the owner of the script that created the file or directory? Because of this problem, I can't delete any of the files or directories my scripts create using FTP, I have to secure shell into my server using my root account to be able to remove these files and directories. any way around this?

[blaw]

Hi again,

So if the script is not owned by a superuser, then there is no way of chowning a file or directory?

A good explanation can be found on PHP.net (http://ca.php.net/chown) I quote it below:

Originally Posted by njs+php at scifi dot squawk dot com

If you allow sudo execution for chmod by "nobody" (www, webdaemon, httpd, whatever user php is running under)in this manner, it had better be a system on which the owner is able to be root and no one else can run code, else your whole system is compromised. Someone could change the mode of /etc/passwd or the shadow password file.

Other system commands (sudo mount) and so forth are similar.

Regarding mkdir()-created file, it does not belong to your username (UID) because it is created by the script excuted by - it could be anybody. As far as I am aware, the only way for the server to know for sure that it is created by you (hence the file belongs to you) is when you login to your account and create a file there.

Hope this gives you the idea.