fwrite permissions for users of a webpage

Question

I'm going to allow my users to make iframe d HTML pages on my site. They will input text including markup and I will create the .html file using fwrite() .

Are there reasons not to make the file permission for these .html files 0777 ?

Obviously I don't want people executing javascript but other markup should be fine. Should I do 0766 instead then?

I'm not very familiar with permissions so general advice would be appreciated too.

Answer 1

0777 is inappropriate for data files such as HTML. They should likely be set as 0644 (owner read+write, group/others read only).

Note that the executable bit on an HTML file has absolutely no bearing on what permissions it will have when loaded in a browser. For instance, Javascript will run just fine out of any HTML file, regardless of its permissions -- if you do not want to allow Javascript to run from these files, you will need to filter the content yourself. Good luck.

Answer 2

如果你能确保，他们将只上传HTML文件-那么它的罚款。