PHP - File ownership/permission issue - Uploaded file cannot be accessed/not found after it was uploaded

Question

I am using this Simple-Ajax-Uploader plugin to upload files, then I used This PHP library to handle the processing of the files, to do things like generating random file names, resizing and specifying a directory to save the files, etc.

Here's the code:

<?php
require('../classes/class.upload.php');
require('../classes/User.php');

//Process a file uploaded via XMLHttpRequest
$handle = new upload($_FILES['uploadfile']['tmp_name']);
if ($handle->uploaded) {
    $handle->file_new_name_body = User::generateRandomString();
    $handle->image_resize = true;
    $handle->image_x = 360;
    $handle->image_ratio_y = true;
    $handle->process('temp-uploads');
    if ($handle->processed) {
        echo json_encode(array('success' => true, 'newfilename' => $handle->file_dst_name));
        $handle->clean();
    } else {
        exit(json_encode(array('success' => false, 'msg' => $handle->error))); 
    }
}

Well, the file will upload successfully but somehow it becomes inaccessible via any web page, it's also inaccessible if I try to access the "site-name.com/directory-name/filename.jpg" on the browser. It shows 404 Not found.

I also thought it could be file permission issues, but after giving the uploaded files including their directory) all possible permissions, they are still 404 Not Found. Right now, files uploaded by ajax are visible in cPanel file manager but not accessible in URL.

Finally, out of curiosity, I uploaded another file directly to the server via cPanel and that one was accessible, but the others still mysteriously remain inaccessible with 404 Not Found. I also renamed one of the inaccessible files to test.jpg, but it remains inaccessible. I tried to search for similar problems here but can't find one.

Please what is going wrong here?

Edit:

I have discovered that this was a file ownership permission issue, the directory where files are uploaded and the files within it are having different owner usernames of 1128 and 99 respectively. I have modified the title of the question to include "File ownership/permission issue".

Also I found the following message in the error logs repeatedly for each file uploaded:

[Sat May 26 09:28:05.584102 2018] [core:error] [pid 9320:tid 140646036481792] [client 209.126.90.118:59372] Caught race condition abuser. attacker: 1128, victim: 99 open file owner: 99, open file: /home/royalsee/public_html/php/MichenoCoop/dashboard/temp-uploads/32_3.JPG, referer: http://michenocoop.com/dashboard/temp-uploads/

so the files uploaded by ajax are visible in Cpanel file manager but no accessible in URL? — akshay khairmode, May 25 '18 at 18:27
Here's a link to the said directory: http://michenocoop.com/dashboard/temp-uploads/ — Jevison7x, May 25 '18 at 18:28
So the minato image was uploaded by Cpanel i believe. Is there any difference in file permissions for the 3 files? The permissions are displayed in cpanel file manager i believe — akshay khairmode, May 25 '18 at 18:29
Seems like it. i will get back to you if i find anything regarding this — akshay khairmode, May 25 '18 at 18:37
Is there anything noteworthy in any .htaccess files? Check all directories along the file path. — Anthony, May 25 '18 at 18:40
wow, that process() method is almost 2000 lines... hard to follow everything it does. I do see that it logs, though... have you checked that for errors or anything? — Justin McAleer, May 25 '18 at 19:05
I am seeing something like this: [Fri May 25 14:58:25.957345 2018] [core:error] [pid 6034:tid 140489428780800] [client 137.118.48.22:43348] Caught race condition abuser. attacker: 1128, victim: 99 open file owner: 99, open file: /home/royalsee/public_html/php/MichenoCoop/dashboard/temp-uploads/HzFncYcWxQ.jpg — Jevison7x, May 25 '18 at 19:17
Do you found the solution? Did some answer help you? If yes, try to upvote and close the question in order to maintain S.O clean and help others in the future. If no we can still help.. thanks! — JP. Aulet, May 27 '18 at 16:51
Yes, I found a solution, see my answer below. I tried to accept my answer, but I was told I can't do that for 24 hours. I think it's about time now. — Jevison7x, May 27 '18 at 19:21

score 1 · Answer 1 · answered May 25 '18 at 19:36

1

I know that you already checked that:

could be file permission issues, but after giving the uploaded files including their directory) all possible permissions, they are still 404 Not Found

But maybe the problem is with ownership of the file, according to this S.O answer What's the meaning of this error message in error log?:

Bad permission or ownership can also trigger this error. I have resolved it by changing ownership of my application directory. It was owned by root before.

And here again with the same error you get in your log file:

https://alexantop.wordpress.com/2013/05/07/caught-race-condition-abuser/

with the same solution:

Change the files ownership to “username”.

Can you check the ownership of the folder and try to change it to www-data or some user that can be accessible from internet.

Hope it helps!

answered May 25 '18 at 19:36

JP. Aulet

4,375
4
26
39

I think what you are saying makes sense, but I don't know how to check/change ownership in cPanel, I can't find anything like that. – Jevison7x May 25 '18 at 19:47
Also when I viewed my FTP client window, I saw a column for Owner, all folders including that "temp-uploads" folder has Owner as 1128. However when I opened it, the files that are not accessible has Owner as 99 while the accessible file has Owner as 1128. What does this mean? – Jevison7x May 25 '18 at 19:51
I think that the ownership is the problem, I'm researching a little but if you have FTP/shell access you can try to change it or use this guide to check it: https://stackoverflow.com/questions/8077076/cpanel-change-ownership-of-files But the ownerships *names* are weird.. – JP. Aulet May 25 '18 at 20:01
Another thing you can do is try to upload the file to another folder, here I found a list of default CPanel folders and ownerships/permissions: https://hoststud.com/resources/how-to-set-default-files-and-folders-permission-ownership-in-a-cpanel-account.67/ Maybe it works for you. – JP. Aulet May 25 '18 at 20:09

score 0 · Accepted Answer · answered May 26 '18 at 15:04

The problem was resolved when I contacted support of my hosting provider.

I asked them to explain what was the cause and they replied with this:

Whatever that means I have no idea, however my problem was solved, so I am posting this to help anyone else who may be having the same issue. I hope it helps.

PHP - File ownership/permission issue - Uploaded file cannot be accessed/not found after it was uploaded

2 Answers2