77 Permission Problem with Upload

olddocks · 01-18-2008, 07:58 AM

i am very worried about assigning 777 permissions to anything that is uploaded via PHP script. i own a dedicated server running centos with cpanel.

I read somewhere that assigning the apache or nobody ownership to the upload folder is a good security measure. I did try assigning nobody to the upload folder using

Quote:

chown -R nobody uploads
chmod -R 770 uploads

It looks like not working for me. Here is what the problems i have...

Eventhough now apache is only able to write and no world permissions, when i point to http://url/folder the file contents are listed. i dont want anybody to see whats inside the upload folder. It should get forbidden error? isnt it?

i am confused here...

whats the best way of securing upload folders?

Acron_0248 · 01-18-2008, 08:37 AM

Hi,

I think that you're looking at the wrong place trying to secure your files...

What you should do to avoid the listing of the uploads directory is use a .htaccess file in the uploads folders with any of this directives:

You could use <Limit>:

Code:

<Limit>
Order Deny,Allow
Deny from all
</Limit>

You could use <Directory>:

Code:

<Directory /path_to_folder>
Order Deny,Allow
Deny from all
</Directory>

And, you could use IndexIgnore:

Code:

IndexIgnore *

Regards