4

I am setting up a simple website on webspace provided by my university. I do not have database access so I am storing all the data in a flat file. The issue I am experiencing is related to file permissions. I need PHP to be able to read and write the data file but I don't really want to set the file to 777 as anybody else on the system could modify it, they already have read access to everyone's web directories. Does anyone have any ideas on how to accomplish this?

Thanks in advance

1
  • 2
    Change the owner or group to the webserver user and give the webserver user and yourself write permission to the file
    – topdog
    Sep 18, 2012 at 13:07

4 Answers 4

5

Just set 0755 (or lower) but make sure that directory owner is user in which context is apache (or other webserver) running.

for example

chown apache:apache /var/www/html

You can get info about user using phpinfo() for example.

UPDATE

If you are sharing apache with more sites, then you should separate your content by Per-user web directories

http://httpd.apache.org/docs/2.2/howto/public_html.html

5
  • 1
    This looks good but wouldn't everyone on the server potentially be using the same copy of Apache and could then create a script to overwrite my files? Sep 18, 2012 at 13:16
  • Yes, that's correct, see my updated answer
    – user106666
    Sep 18, 2012 at 13:57
  • per-user web directories don't really help. Apache is still running as Apache.
    – Zoredache
    Sep 18, 2012 at 16:17
  • @Zoredache what you mean by don't help? This is exact case for mod_userdir
    – user106666
    Sep 18, 2012 at 16:37
  • Files written by Apache will under mod_userdir will still be owned by Apache. Nothing prevents one user from writing a script to by be run by Apache that will snoop in other users directories.
    – Zoredache
    Sep 18, 2012 at 16:40
4

You may use suPHP to accomplish this task. If you can use it, then simply change the file permissions to 0700 and everything shall work as you want.

2

The ideal situation would be if the filesystem on the server supports posix acls so you can add write access to certain files for the uid the webserver runs under.

And you have enough access to the filesystem (preferably via a shell account) to set acl rights.

See man acl for an overview and man setfacl for details on how to set them.

0

You can use the command below to set read/write permission:

sudo chown www-data PATH

if the www-data is not exist, you can replace it with apache:apache or apache.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .