Security Issues with running php scripts on a site

[scorpion]

I'm trying to wrap my head around the potential problems of running a php script initiated by a surfer which needs to write to the hard drive.

e.g.
suppose your script is called:
mysite.com/content/script.php

And suppose this script must create a directory and write a file to it.

The first problem I've had is that if my script does a mkdir('/adir', 777), this directory and all files within it can no longer be deleted by me on the server since the permissions are for user 'http' vs 'sysadmin' (my admin account).

Furthermore, unless the directory 'content' is not all 777, you pretty much can't do any writing.

Is there an article on php scripts that must run in the browser and how to handle permissions, writing, reading, deleting, etc.. properly on a unix system?

I really hate having to 777 my whole script directory just to get it to work online...

The other thing that I don't get is:
if you chmod 777 a directory does that mean you can do anything to any file/subdir below it, or you must 777 recursively everything in the directory?

[Knowles]

The first problem I've had is that if my script does a mkdir('/adir', 777), this directory and all files within it can no longer be deleted by me on the server since the permissions are for user 'http' vs 'sysadmin' (my admin account).

If it is 777 you should still be able to delete it.

if you chmod 777 a directory does that mean you can do anything to any file/subdir below it, or you must 777 recursively everything in the directory?

This should only be it directory and above. It should not effect the directories below.

Also you could make it make to a different directory than your script directory to keep those files from being 777. Sorry I dont have any links to give. You might try asking in the *nix forum too. Also I may be wrong on this but a bump should help pull some people who may know better than I.

[scorpion]

What happens is, the script creates a directory with permissions 777, but if I login using my user account to the system, the directory and files created show like this:

-rwxr-xr-x 1 sysadmin sysadmin 179523 Jun 17 11:04 file1.jpg
-rwxr-xr-x 1 sysadmin sysadmin 194852 Jun 17 11:04 file2.jpg
drwxr-xr-x 2 http http 4096 Jun 17 11:26 thumbs

Now the thumbs directory and subfiles are created by the script run over http. So if you try to delete a file in that directory from sysadmin it says, "rmdir: `thumbs\file1.jpg': Permission denied".

Does this sound like a configuration error or is normal behaviour?

[Slade]

It is normal behaviour if you're running php as a module. Try renaming the first called php file to .cgi and giving it "+x". This should cause it to run as a different user than the web server.

You may need to have a suid-cgi-bin for this to actually work. If you don't have a control panel that you can verify this from, ask your host.

edit: Silly me... You also have to add the magic processing line at the beginning: #!/path/to/your/php