i've build a small upload system using PHP, it is working just fine for now however, the problem i have is the way i've got it to work.
I don't have much of a background in security, but is what i'm trying to learn at the moment.
So in order to get the file upload system to work i needed to change the permissions for a folder that i wanted to put the file into.
So i have a windows server, i located the folder > right click > properties > security > edit
Here there is a list of 5 groups
So When i'm uploading a file, it uploads to temps files, then the system moves the file to the right location lets say /vids .
Originally the "Users" group permissions were set to "deny" on the write permission meaning the users group could not write files to this location, this means that when the system tries to move the file it gets a permission error.
So i change the "Users" group write permission to "allow" write and it the file upload and move works just fine. However i am worried that this is bad practice from a security stand point?
From what i would see was that if it has the write permission an attacker could put a script in that location and then execute it, is this correct? If so how do i get around this and make it more secure?