-1

I'm trying to copy and unlink files on my apache server. I'm trying to doing this about 1 hour ago. I can't imagine what's the problem.

This is my source:

if (copy("users_ftp/".$user_ftp.'/'.$_REQUEST['name'],"uploaded/".$name_file)) {
  chmod("users_ftp/".$user_ftp, 0777);
  chmod("users_ftp/".$user_ftp.'/'.$_REQUEST['name'], 0777);
  if(unlink("users_ftp/".$user_ftp.'/'.$_REQUEST['name']))
  {
    // success, do stuff
  } else {
    print('nem törölt fájl'); 
  }
} else {
  print('sikertelen copy');
}   

I tried to use it like this:

copy("/var/www/virtual/tigyisolutions.hu/boxy/htdocs/users_ftp/".$user_ftp.'/'.$_REQUEST['name'],"/uploaded/".$name_file)

But same error.

This is the error:

Warning: copy(/uploaded/ftp_dir_collect.php): failed to open stream: No such file or directory in /var/www/virtual/tigyisolutions.hu/boxy/htdocs/upload.php on line 261
sikertelen copy
Warning: md5_file(uploaded/1782848509512876a6863a2-08-58-30.php): failed to open stream: No such file or directory in /var/www/virtual/tigyisolutions.hu/boxy/htdocs/upload.php on line 270

Warning: sha1_file(uploaded/1782848509512876a6863a2-08-58-30.php): failed to open stream: No such file or directory in /var/www/virtual/tigyisolutions.hu/boxy/htdocs/upload.php on line 271

It says no stream. But I verified that the file exists on my FTP. I used chmod 777, but it's not working. What else can be wrong?

1 Answer 1

1

Most likely it's permissions or an invalid filename. The paths code you provided don't quite match the paths in the log. I'd suggest you verify that you access the correct directories and files.

You didn't share the permissions on the directories in question. Just because it is accessible by FTP doesn't mean the Web server can access it too. Use namei like this if a directory is accessible to a user:

sudo -u <username> namei -m /path/to/target

where <username> would be the user your web server (Apache?) is running as.

I suggest you write your code more like this (https://stackoverflow.com/a/6070449):

if (file_exists($fileToCopy)) {
    if (is_readable($fileToCopy)) {
         if (is_writeable(dirname($target))) {
             copy($fileToCopy, $target);
         } else {
             die('You dont have permission to write into '.dirname($target));
         }
    } else {
         die('You dont have permission to read '.$fileToCopy);
    }
} else {
    die('File '.$fileToCopy.' does not exist');
}

This will tell you where the permissions are off. You didn't share which (Unix-based) OS you are running this on, things like SELinux can be to blame for this too. Check by reviewing auditd's log files.

Concerning the glaring WTF in your code:

Never, never under the threat of slow, agonizing death, use user input unchecked in your code. The code as posted could be manipulated to write system files into a directory that is potentially served by the web server. This invites all kinds of shenanigans.

More info on Remote File Inclusion and Code Injection

0

Not the answer you're looking for? Browse other questions tagged .