Apache/PHP

Influx · 10-21-2005, 10:19 PM

Not sure if i'm asking in the right place, but I just installed apache and php (from linuxpackages.net), everything is running fine as I can tell, but my scripts I made and ran in windows no problem, in linux it's not writing to file. Do I have to set up permission somewhere? Can someone help a newb. Thanks :|

Here's an example script that I'm playing with:

Code:

<?
$redirect = $_SERVER['PHP_SELF'];
echo "ready..";

if (isset($_POST['thetxt'])) {
	$da = "test.php";
	touch($da);
	$wr = fopen($da, "w");
	fwrite($wr, $_POST['thetxt']);
	fclose($wr);
	echo "wrote to <a href=$da>$da</a><br>";
}
?>
<form name="write" method="post" action="<? echo $_SERVER['PHP_SELF'] ?>">
<textarea name="thetxt" rows="30" cols="50"></textarea><br>
<input type="submit" name="go" value="Go">
</form>
<?
?>

Just so you get the idea of what the problem is.

tedfordgif · 10-22-2005, 01:08 AM

The most trivial way to get this to work (and be sure it's a privilege issue) is do just what the php code does (almost):
su -
touch $file
chmod a+w $file
chown nobody:nobody $file

The last line is optional. It's not smart, but it should eliminate any permissions issues. Then you will want to delete that file.

Influx · 10-22-2005, 05:50 AM

so I changed the group of the file to nobody, and allowed write access for group, and it seems to work. Now my question is, is this a security concern now that I have a text that will be read from/written to? What should I be worried about here?

tedfordgif · 10-23-2005, 10:50 PM

Yes, there are security concerns. At the very least, an attacker may be able to execute arbitrary PHP code, allowing them to probe for other weaknesses on your system, perform an exploit against your application, etc.

What need are you trying to fill?