Is setting the uploads folder 777 permission secur

问题:

I have seen a lot of upload forms hacked, and some had some really good security checks of the file being uploaded (at least I think so), but still somebody managed to upload a PHP file.

I was wondering: is there is a way to upload a file in the uploads folder that has 777 permissions? I am thinking of using HTTP PUT.

回答1:

In general 777 is about as insecure as it gets... that means anybody can read and write to your files.

HTTP PUT isn't inherently any more secure than HTTP POST if you're allowing the uploaded files to be exceuted on your server.

Overall, if you are allowing arbitrary files to be executed you need to be doing very good file checking server-side, and using chroot on the server would be wise.

Permission-wise, I generally set anything web-accessible to 644 owned by the webserver user.

回答2:

Folder permissions is just to make sure your httpd/Apache user can write to that folder. Actually you don't need to chmod 777 for your storage folder. Just make sure to either set owner to root and group to the Apache/httpd user you are running or just simply set the folder owner to your Apache user.

chmod 774 /upload/folder: writable for owner and group and the others just read.

PHP: if somehow that folder refers to user document root folder you can disable the PHP engine for that particular virtualhost.

If that folder is part of your system/application document root folder editing the .htaccess file and using the removeHandler Apache directive might do the trick.

回答3:

You don't need and shouldn't have a 777 permission on an upload folder. It should be enough to have it only read and writeable for the user the Webserver is running in (with apache/debian usually www-data). Additionally you should turn off (e.g. via .htaccess) anything you don't want to happen in this folder, like executing PHP scripts (so even if it happens that a user uploads a PHP it can't be executed). HTTP PUT doesn't change your 777 problem, cause the file will still be there after it has been uploaded.