File uploaded through form gets wrong permissions

[Pedja]

I have this problem for quite a time and cannot get the solution.

I have simple form that allows user to upload file. File is moved from temporary location to specified location on site and it is available for downlaod through direct link to file.

Problem is that file does not get proper permissions and it is not accessible by user.

Code I use is this (simplified):

  $file = strtolower($_files['f_file']['name']);
  
  $putfile = UPLOAD_FILES_PATH . $file;
    
  move_uploaded_file($_files['f_file']['tmp_name'], $putfile))

File is stored in proper place but its permissions are 600

I even tried to force permissions after file is moved, but it does not work. I tried chmod($putfile, 644) which should be set and even chmod($putfile, 777) but then i get really strange permission like 411.

All this worked fine before some server upgrade occured so I guess it may be some problem with server setting.

By searching net, I have found one interesting observation that may be related to my problem: "It seems that move_uploaded_file use the GROUP permissions of the parent directory of the tmp file location".

That could explain that permissions of moved file are wrong, byt why setting permissions on the file does not work?

[Pedja]

I just tried this:

print "UMASK IS .".`umask`.".<br>\n";

and got

UMASK IS .0022 .

Maybe this is a problem?

[Frank Hagan]

I also have a intermittant problem with a photo posting script; permissions have to be changed manually every now and then on uploads (and other times it works fine).

Let me know what you find out ... I've always blamed it on the worst photo posting script ever.

[djn]

Same problem with an upload script I use on 10-12 websites, all on cpanel17. Only one gets wrong permissions, the others work well (the script is exactly the same). Started to happen 9 months ago, after years of uneventful operations (no changes were made).
Any hint?

[Buddha]

Chomd, in PHP, expects an Octal.

Note that mode is not automatically assumed to be an octal value, so strings (such as "g+w") will not work properly. To ensure the expected operation, you need to prefix mode with a zero (0):

<?php
chmod("/somedir/somefile", 755);  // decimal; probably incorrect 
chmod("/somedir/somefile", "u+rwx,go+rx"); // string; incorrect     
chmod("/somedir/somefile", 0755);  // octal; correct value of mode
?>

Hope that helps the chmod thing.

[Pedja]

Well that was the problem. When I used 0644 it worked.

Strange thing is that script worked fine for a long time and then, after one upgtade on the server it stopped.

I am bit embarrased about this beginner alike oversight

Thanks, I learned one more thing.

[james]

I have just created an image upload script for my site, and I too get the permissions set to 600 by default.

Is there a reason for this?

It seems odd that the file isn't web server readable by default?

[Buddha]

I have just created an image upload script for my site, and I too get the permissions set to 600 by default.

Is there a reason for this?

It seems odd that the file isn't web server readable by default?

There's no way for the server to guess a users intentions therefore it errs on the side of caution. It's just a good security practice.

[james]

So would this have been changed and implemented on the new servers?

I'm just trying to work out why things would have suddenly changed for the others?

What configuration option would have been change? (I have a VPS elsewhere, and am thinking about implementing the same thing there also).

Thanks.

[Pedja]

Just do chmod after moving file from temporary directory.

$file = strtolower($_files['f_file']['name']);

$putfile = UPLOAD_FILES_PATH . $file;

move_uploaded_file($_files['f_file']['tmp_name'], $putfile))

chmod($putfile, 0644);