Assigning folder permissions in PHP

[frosty7700]

I'm creating a website in PHP that allows users to download files in a specific server directory to their machines. What are the recommened permissions for this and what's the best way to handle it? It's on an OSX server (i.e., permissions handled similar to Linux). The non-web users need to be able to copy files into the folder, and the web users should only have read-access. I've never done this type of thing on a non-NT server.

 

[sleipnir214]

If you are doing this through PHP (as opposed to FTP), then the user that requires write permissions to the directory is the user your web server runs as. Want the best answers? Ask the best questions:

http://www.catb.org/~esr/faqs/smart-questions.html

TANSTAAFL!

 

[frosty7700]

Actually, all file writing will be performed by a local user.

Only read access is necessary for the web user.

Whenever a web-user is created by the admin, a corresponding folder is created by the PHP. I guess what I need to know is how to set the permissions on the folder's creation in PHP to allow read access by the web user and normal access for anyone else. Again, no files will be uploaded through the web, only downloaded.

 

[sleipnir214]

Does any logged-in user have to be able to access any of the files writting by any user? Want the best answers? Ask the best questions:

http://www.catb.org/~esr/faqs/smart-questions.html

TANSTAAFL!

 

[frosty7700]

The web user needs to be able to download any file placed in the directory by a local user on the server. The local user is the only person (for now) who will be placing files in the directory. The logged in user will only have access to the directory created specifically for him/her when the account is created by the PHP.

Timeline is as follows:
-Admin logs into system
-Admin creates new user, signaling PHP to create new folder for the user on the server
-Local server user goes into file system and copies files into user's directory whenever the need arises
-User logs into intranet and download files from his directory

So, literally all I need to know is what permissions to set the folder to in its creation in the 2nd step so that the web user only has Read access without handicapping the full access of the local server user. Keeping one web-users folder 100% secure from other web users is not a huge priority. And the PHP/Database routes them to their designated folder.

Hope this clears up my goals.

 

[frosty7700]

I should clarify that I have already implemented just about everything. I only need to know the permissions stuff.

 

[sleipnir214]

If logged-in user "A" writes a file, I understand that PHP (and thus the web server) needs to read the file. What permissions would a second logged-in user "B" require to the file? Want the best answers? Ask the best questions:

http://www.catb.org/~esr/faqs/smart-questions.html

TANSTAAFL!

 

[frosty7700]

Nah...no logged in user will be writing any files. Even though the PHP creates a folder when a new user is created, only a local server user will be writing any files to that folder at any time.

The only access any logged-in user needs to the creatd folder is Read access. Only the LOCAL user needs write access to the folder.

 

[skiflyer]

So there's your answer, the locally logged in in user needs write access (and I'm assuming read as well) to their own folder.

Logged in users (namely the web server) needs read access to all these directories.

If you're wondering what the chmod command is, you'll need to actually make it so the local user OWNS the directory in question... then the settings will be

owner= read/write
group= read
world= read

otherwise known as

chmod 644

-Rob

 

[frosty7700]

So, will that work properly if it is run during the directory-creation portion of the PHP?

 

[frosty7700]

In other words, will the PHP know that the owner should be local by default, or do I need to run a CHOWN too?

 

[sleipnir214]

You do not need to run chown. Want the best answers? Ask the best questions:

http://www.catb.org/~esr/faqs/smart-questions.html

TANSTAAFL!

 

[skiflyer]

I'm getting a little confused on what you're explaining.

What is PHP doing creating the directories for local users? Do you have a separate app going on there for that?

The short answer is no, you shouldn't have to run a chown, but the long answer is... from how you described it, I didn't figure PHP was going to be creating any directories... basically, as sleipnir said above, anytime the webserver is running, you're going to be coming in as world...

So I guess I'm wondering... when you say local user do you just mean the user is at the server but running the web page?

-Rob

 

[frosty7700]

By "Local user" I mean a person physically at the server who is accessing through the filesystem, not through the web.

However, the site/web-app has an admin section PHP in which new web users can be added to the backend DB, and this same PHP also creates a directory set aside for that new web user so they can download (ONLY download) files pertinent to them. BUT...and this is where I think you guys are lost...files can for now ONLY be added to that directory locally, NOT through the web app (even though the web-app created the directory). I know it's weird, but thems the specs. Hey, I only work here.

So, only the person sitting at the server (or, ideally, possibly accessing through the network) should have write access to the directory once it is created. Users coming through the web-app should only have read access to this same directory.

 

[skiflyer]

Well then, 644 would be the same as 666, because the web app is going to "own" the folder, not the creator.

I doubt the webapp will have the permissions to run a chown, and I doubt you'd want to in case someone's logins didn't match exactly...

As I see it, and there's a good chance I'm just not seeing it right here or I'm just plain wrong, you need to set these permissions on the server locally, NOT through the web app.

-Rob

 

[frosty7700]

Well the problem with that is that the App's Admin section needs to dynamically create a user directory on user creation for the site.

Argh.

 

[danielhozac]

Since the webapp is creating the directories and files, it would have the permissions both to chown and to chmod. //Daniel