Switching the user that a PHP script runs as

Not for 'how-to' coding questions but PHP theory instead, this forum is here for those of us who wish to learn about design aspects of programming with PHP.

Moderator: General Moderators

Post Reply
User avatar
mchaggis
Forum Contributor
Posts: 150
Joined: Mon Mar 24, 2003 10:31 am
Location: UK

Switching the user that a PHP script runs as

Post by mchaggis »

Hi,

I have developed a filemanager for an intranet, now it would be really kewl to allow the users to upload files to there home directory, the box is linux and I have full control over it.

The users I am talking about all have unix accounts on this server, and the web interface is for when they are on the office network. Now as it stands you can browse your home directory and download files, but I would like to go that one step further and allow them to upload files.

Security isn't really an issue as they can't browse the full system, just their home directory and the public area.

My problem is that while file uploads are trivial, PHP scripts run as the same user as apache (apache/nobody) and thus has no write permission to write to these directories, or more to the point chown these files to the correct ownerships after uploading.

I the obvious (but silly and dangerous) way would be to run apache as root, but we all know that is a great big no no! I have seem various cgiwrappers that allow switching of user (setuid) I have not come across anything like this for PHP.

There is a crude way of doing this, using samba, as we allow people to connect to their home dirs via samba and seeing as my script knows their username/password from their login I can access their home dir via samba but this is a memory hog and seems pointless to make a network connection to local host for the sake of copying a file.

There must be a simple way???

Al,
Post Reply