Page 1 of 1

Complicated file upload problem

Posted: Sat Apr 23, 2005 7:48 pm
by kirilisa
Hello, I am trying to do something that seems like it should be fairly simple and is turning out to be totally impossible.

I have a site that is hosted, not by me, but by a hosting company: i.e. I have no server access whatsoever. I want to make a page that allows someone to upload an image to be stored in my public_html on the hosting company's server.

I tried to do this via $_FILES, but it does not work, as the place where the image is successfully uploaded to temporarily is a place that I am not allowed to copy from. That is, when using $_FILES, my uploaded file goes to /var/tmp/ and when I do a move_uploaded_file() it gives me a Permission Denied error.

The first thing I tried was using ini_set to set upload_tmp_dir, but this did not work (I'm sure the hosting company doesn't allow those privileges). The second thing I tried was creating an .htaccess file in my public_html that said the following:

Code: Select all

php_value upload_tmp_dir /home/hearchri/public_html/Model/Book/book_images/large_images/


This also did not work. (Is the .htaccess supposed to be in the document root or in the folder that you want to become upload_tmp_dir?)

Nonplussed, I decided to try to use FTP instead of $_FILES.

I have, in short, some code that results in looking like this:

Code: Select all

$source_file = "C:/Temp/sourcefile.jpg";
$destination_file = "destfile.jpg";

ftp_file($source_file, $destination_file);

/* FUNCTION (in included file) */

function ftp_file($source_file, $destination_file) {
  $conn_id = ftp_connect('ftp.server.com'); 
  $login_result = ftp_login($conn_id, 'username', 'password'); 

  if ((!$conn_id) || (!$login_result)) { 
    echo "FTP connection has failed! ";				 
    exit; 
  } 

  $upload = ftp_put($conn_id, $destination_file, $source_file, FTP_BINARY); 

  if (!$upload) { 
    echo "FTP upload has failed!<br>";
  } 

  ftp_close($conn_id); 
}
Now this does not work either. I get 'FTP Upload has failed!' I am assuming that the problem is that as PHP and FTP are both running on the same server (that is, my hosting company's server), PHP is looking for the source file, C:/Temp/sourcefile.jpg on the server that PHP is running on, and not on my local machine, where the source file is actually located. If this is so, what do I do? Does this mean that all of the PHP FTP functions do not work at all unless you are running PHP on the same server that you are uploading the files from? That doesn't make sense because then you could just copy the file using the file system and you wouldn't need FTP.

How do I make it so that FTP, even though called by PHP running on a server that is NOT the machine I am trying to upload a file from, knows how to find the file on my local machine?

I'm so confused!

Thanks,

Elise

Posted: Sat Apr 23, 2005 8:28 pm
by hongco
$source_file = "C:/Temp/sourcefile.jpg";
and if you think you can write a script and it automatically uploads files from a user's machine, we would be no longer able to surf internet :) because users' files will be stolen.

You may want to read this tutorial or search on google on how to upload image using php.

http://www.phpfreaks.com/tutorials/36/0.php

Posted: Sat Apr 23, 2005 10:22 pm
by kirilisa
Actually, I do know the standard method of uploading an image using PHP. That is what the first section of my post was all about.

My issue is, once the file is uploaded using the $_FILES method, I cannot move it from the tmp location, since I do not run the server, and thus don't have permission to move the file.

The whole reason I was trying to make an FTP solution work in the first place was because I couldn't get the standard PHP $_FILES method to work, given my permissions problem, which I tried to solve in two ways, but failed, as described in my first post.

And yes, of course I see that stolen file issue, but then, my question is, what is the purpose of having PHP FTP capabilities at all, since that issue would always apply?

Posted: Mon Apr 25, 2005 9:57 am
by pickle
You may have rights to copy even if you don't have rights to move the file.

copy()

Posted: Mon Apr 25, 2005 11:39 am
by kirilisa
Unfortunately with copy() I get much the same error as with move_uploaded_file(). Frankly I don't understand why they have Uploads = On if they don't intend to let people move/copy the tmp uploads...

In any case, here is my code:

Code: Select all

/* HTML form */
<input name="userfile" type="file">
<input name=submit type="submit" value="Upload" onClick=put_value();>

/* PHP form handling */
if ($_FILES['userfile']['error'] == 0) {
  $filename = $_FILES['userfile']['name'];
  $tmppath = $_FILES['userfile']['tmp_name'];

  $newfiledir	= "/home/hearchri/public_html/Model/book_images/large_images/"; 
  $newfilepath = $newfiledir . $filename;

  copy($tmppath, $newfilepath);
}
When I browse to a file, select it, and submit it, I get the following error:

Warning: copy(/home/hearchri/public_html/Model/book_images/large_images/carrot_cake.jpg): failed to open stream: Permission denied in /home/hearchri/public_html/Control/index.php on line 189

I am assuming this means I can't copy files from the server's tmp location...

Thanks,

Elise

Posted: Mon Apr 25, 2005 3:18 pm
by pickle
This may be a pointless question, but are you sure its the source directory that is giving you permission problems? Try just opening the source file to see if you have permissions to do that. If you do, the permission problem is on your end.

Remember, the PHP scripts are likely running as the 'apache' user, so unless the target directory is set up to be world (or group, depending on your setup) writable, you'll get that error.

Posted: Fri Apr 29, 2005 10:47 pm
by hanji
I'm guessing that the upload directory has the wrong permissions.. as the error suggests. Your directory is most likely owned by your account in the 'users' group. Here are two possible ideas.

1. write a script that takes advantage of mkdir. The upload script will be owned by 'apache' or whatever the server is running. That's the problem.. you are trying to move or copy a file that is owned by 'apache' into a directory that is owned by you with the permissions of 755 (drwxr-xr-x). By executing a script that creates a directory, you'd be creating a directory that is owned by apache.. and then it should allow you to move the file in there.

2. Option #2 is the quick fix.. but wrong permissions. You could FTP to your account, and change permissions on the directory to 0777 (drwxrwxrwx) allowing anybody access to write to that directory. That's not smart... so focus on option #1.

There is a third option.. You may be able to use the chown() to change ownership of the directory. chown('/full/path/to/your/upload/dir','youraccount:apache'); then chmod() it to 775. this will give read, write, execute to the owner and group.. again. this should let you move/copy a file from tmp.

These are just a few ideas.. there other options still.

HTH
hanji