Recently it has become an issue that a user on one of our systems needs the ability to have the apache user have read and write capability to their site so that the upload portion of their site works correctly. How would you minimize the risk of somebody malicious going in and submitting a file that ends up being able to delete files in the web directory or worse yet taking over the apache daemon?
The only solution I have been able to come up with is to create a subfolder for the site that apache can read and write to but can only read parent directories. With sanity checks (like
file foo.zip) and file checks being done on the uncompressed uploaded data and then having the file being renamed and meta data being added to the file to track it internally for the site before being moved into a folder that is not writable by apache and only readable.
Or am I just being paranoid?