in reply to Re: Image Upload
in thread Image Upload
If I understand the original intentions right, the author tries to ftp-upload the newly-http-uploaded files. We used this technique once to achieve more security. The problem was that the uploading (or better say 'handling-the-form-with-a-file-attached') CGI script was running as user www. That's the usual case under Apache without suExec. So we had to permit www user to write to the directory where user-uploaded files were to reside.
And we used another idea instead. When we get a http-uploaded file somewhere in the /tmp dir (CGI.pm scripts usually do), we just ftp-upload it to our own directory. This method let us not to give away our own, say, /uploaded-images dir to www user, which, of course, was the owner of all CGI processes on that machine.