Re: Successfully accessing files

Hi ghosthider,

There's not a ton of detail there, but my guess is that you're uploading a script and some support files via FTP, then trying to run the installation script via a Web browser. In that case, the user you FTP in as is often different from the user the Web server runs as, and so the installer script (running from the Web server) is not able to change permissions on the files uploaded as the FTP user.

One solution is to upload a ZIP or TAR file with the support files, then let the installer script unpack them. That way they will all be owned by the Web server user.

It's worth noting that the security of this model is not great. Having all of your code writable by the Web server means that many sorts of errors in any Web program would allow an attacker to make changes to any code which the Web server is allowed to change, including anything which was installed by running a script via the Web browser. The more traditional way of installing code, with an installation process run by a user other than the Web server user, is more secure but is tricky or impossible in some hosting configurations.

--
sgifford's Web page

Comment on Re: Successfully accessing files

Replies are listed 'Best First'.
Re^2: Successfully accessing files by Anonymous Monk on May 01, 2007 at 04:27 UTC
That sounds like a good workaround, sgifford. I think I'll have users directly set permissions on all the scripts, and set up the installation script to only unzip and set permissions on the text files. Sounds like that would be a good way to avoid any security issues. (If my assumption's wrong, just let me know!) Thanks!	[reply]
Re^3: Successfully accessing files by sgifford (Prior) on May 01, 2007 at 05:13 UTC
If the setup program only needs permission to change/install text files, and the text files can't cause your code to do anything dangerous, then that is a very good way to prevent the security issues I mentioned. Good luck! -- sgifford's Web page	[reply]