Welcome to WebmasterWorld Guest from 54.161.118.57

Forum Moderators: coopster & jatar k & phranque

Message Too Old, No Replies

create directory via CGI - problem is, it's owned by nobody

any way to create a directory via CGI that's owned by my userid?

     
9:52 pm on Aug 23, 2003 (gmt 0)

Senior Member

WebmasterWorld Senior Member jeremy_goodrich is a WebmasterWorld Top Contributor of All Time 10+ Year Member

joined:Aug 4, 2000
posts:3468
votes: 0


Basically, I've got a script I'm working on that creates some categories / sub categories that I need to run via CGI / and not command line. When run via shell prompt, the directories created are owned by my userid, however, when run via CGI, the directories & subdirectories that the script creates are owned by "nobody"...

Been digging & digging, no dice - anybody have a pointer or two? Code follows:

[perl]

foreach my $sub (@catlist) {
chomp($sub);
if ($sub!~ m/:/g) {
$sub =~ s/ /_/ig;
$sub =~ s/^ //;
mkdir("../$sub");
chmod("0777, $sub");
print "made top level dir $sub\n";
$sub++;
} # top level category
else {
my($left,$right) = split(/:/, $sub);
$left =~ s/ /_/ig;
$right =~ s/ /_/ig;
my $dirtomake = $left . "/" . $right;
$dirtomake =~ s/^ //;
mkdir("../$dirtomake");
chmod("0777, $dirtomake");
print "made lower level $dirtomake\n";
}
}
[/perl]

11:24 pm on Aug 23, 2003 (gmt 0)

Senior Member

WebmasterWorld Senior Member 10+ Year Member

joined:June 15, 2003
posts:2412
votes: 5


You just use the chown command after the mkdir (before/after chmod, i'm not sure about that), here's an explanation including lookup of the numerical UID and GID (it's easier to give you a link than to copy-paste, it's standard manpage example-stuff and not my page):

[cotse.com...]

/claus

12:10 am on Aug 24, 2003 (gmt 0)

Senior Member

WebmasterWorld Senior Member 10+ Year Member

joined:Mar 27, 2003
posts:664
votes: 0


Depending on your system configuration, 'nobody' might not have permissions to chown (which is a good thing).

You can configure Apache to run as a different user with the "User" directive (see [httpd.apache.org...] )
but before you do, think through any security issues. Personally I think it would be better to have any files created through cgi not owned by any real user, unless it is the user who is browsing the site, and has been authenticated through some sort of login.

12:18 am on Aug 24, 2003 (gmt 0)

Preferred Member

10+ Year Member

joined:Jan 11, 2003
posts:442
votes: 0


You just use the chown command after the mkdir (before/after chmod, i'm not sure about that)

You'd have the script chown the directory after it does the chmod. Otherwise, the script (running as nobody) would try to set permissions on a directory it does not own and likely does not have sufficient permissions on.

1:40 pm on Sept 7, 2003 (gmt 0)

Junior Member

10+ Year Member

joined:Sept 16, 2000
posts:122
votes: 0


When run via shell prompt, the directories created are owned by my userid, however, when run via CGI, the directories & subdirectories that the script creates are owned by "nobody"...

Jeremy,

When the script is run via shell, the directories and files have the correct ownership because you were authenticated when you logged in. If the script is run through a web browser the authenticated user is the user that Apache runs under, usually nobody.

The only real solution is to run Apache with suexec and the correct User and Group for each VirtualHost. Apache will then be running under your UID and GID for your domain.

For security reasons chown should only work for the superuser.