File owner with imagejpeg()?

Discussions of secure PHP coding. Security in software is important, so don't be afraid to ask. And when answering: be anal. Nitpick. No security vulnerability is too small.

Moderator: General Moderators

Post Reply
Lashiec
Forum Newbie
Posts: 5
Joined: Fri Feb 08, 2008 10:17 am

File owner with imagejpeg()?

Post by Lashiec »

A little background... I made a flash program that allows someone to select multiple files (images) and upload them to a server, on the server I have some PHP code to resize the image, apply a watermark, and then resize them again for thumbnails. After these processes are finished I write the file to the server using imagejpeg($target, $source, 60). I'm also using mkdir($path, 0755) to make two directories on the server.

However, when it writes the directories and files they get set to the user "nobody" and I can't delete them off the server anymore (using FTP and cPanel's file manager - Apache server, Linux Redhat 4). I don't have any way to go to the server and login as a superuser to delete files if I needed to, so I'm looking for a way to get these folders and files set so that I can delete them.

I noticed that if the imagejpeg() function writes an image to a folder that I created previously by using my FTP client I can delete that file. This leads me to thinking that it's the mkdir() function is preventing me from modifying the folder and it's contents. I can't even change the name on the files using FTP, nor can I change permissions on the folders.

Similar things happen when I run the website on my own machine (using XAMPP, Mac OSX 10.4). It makes the folders and files, and in Dreamweaver's file view I can't delete the folder/image that was created. However, I can go into Finder and delete them, sometimes I have to put in my superuser password to do so.

Any ideas on what to do so I can delete/modify the files using FTP after they're created? Using Filezilla it shows the folders are created with 0755 permission and the images are created with 0644.
Lashiec
Forum Newbie
Posts: 5
Joined: Fri Feb 08, 2008 10:17 am

Re: File owner with imagejpeg()?

Post by Lashiec »

Well, I found a work around. I just built another page that goes in and deletes all the files with PHP. Since PHP wrote the files, I figured that it could delete them too.

I'd still like to know if there is a way to delete them from the FTP without a superuser account or the account name that PHP gives the files.
User avatar
Benjamin
Site Administrator
Posts: 6935
Joined: Sun May 19, 2002 10:24 pm

Re: File owner with imagejpeg()?

Post by Benjamin »

Code: Select all

 
chmod();
 
Post Reply