PHP Image upload folder

Question

What is the correct way to allow users to upload images to a site? I'm using mod_php so everything is done by apache, not the domains user.

Right now I just chmod 777 the images folder and hope for the best :)

I've been looking at adding an .htaccess file to prevent PHP from running in that folder.

score 0 · Answer 1 · answered Jul 07 '11 at 23:27

0

Ideally, you'd chown a folder to the user account running Apache. This might be 'apache' or 'www-data' or something else, depending on your environment. If the folder is chown'd by that user, you'd only need a permission of 700.

You might also want to check the file upload path in your php.ini file. It may upload the file with a unique filename into /tmp/ and then you'd use move_uploaded_file() to move the image to your 'images' folder.

As far as the .htaccess is concerned, you could also just write a simple index.php script that redirects to some other page on the site, like:

<?php
header("Location: /") ;
?>

So if someone tries to view yourdomain.com/images/ it'll just bounce them back to yourdomain.com

answered Jul 07 '11 at 23:27

iandouglas

176
3

Setting the folder to be owned by apache sounds good. – Slashterix Jul 08 '11 at 00:02
I'm afraid someone will find a way to upload their own PHP file and run it. You don't need to use an index.php since you can just Options -Indexes to disable directory listing. – Slashterix Jul 08 '11 at 00:03
The only way they could upload a file to your system is via FTP or by POST'ing it to a form on your site. Either way, your hosting environment should protect you from malicious users. – iandouglas Jul 08 '11 at 00:22

score 0 · Accepted Answer · answered Jul 08 '11 at 09:15

"I'm using mod_php so everything is done by apache, not the domains user."

I'd suggest stopping that right away; it's not healthy, even in a dedicated hosting environment (but is downright deadly if you've got more than one website on the box). suPHP works well enough for the task.

If your heart is set on sticking with mod_php, I would not recommend changing the user of the directory to match that of the webserver; this prevents effective administration of the site by the user who actually owns it. Instead, change the group of the directory to be that of the webserver, and then give that group write permission to the directory.

PHP Image upload folder

2 Answers2