创建上传目录的最安全方法是什么？

Question

I have an image upload script. I ran into some trouble with permission errors so for the last little while the upload directory has had permissions 0777. Dangerous, I know.

For some reason, it was the only permission that would allow the files to upload. I have now realised that the reason a safer permission didn't work was because of the owner of the directory.

I've been creating my upload directories using FTP. I thought this would be okay. But from what I understand FTP and HTTP aren't in the same group?

I've started creating the directories using PHPs mkdir() allows me to set a safer permission that works with my script.

But before I possibly get into another bad habit. Can someone please confirm that this is the correct way to do it? Is there a better way?

Answer 1

The owner of the directory should be the user which runs your PHP script - on Ubuntu this would be www-data . Shortly, creating folders with PHP mkdir() is okay. Then you should set permissions. 0700 is the most secure but if other user needs to read from or write to this directory, you should add this user to the main group of user which runs your PHP script and set permissions to 0750 or 0770 respectively. On Ubuntu this group is also www-data .