1

Not a specific coding problem but every thread I search where people talk about 777 server files involves server related questions not php.

I realize I shouldn't be setting 777 file permissions on my server due to security concerns. Is there a safer way to use php file writting code such as file_put_contents()? If I don't set file persmissions on my server, code doesn't work and I get errors.

LazyPeon
  • 339
  • 1
  • 19
  • 1
    May be 755 is enough – iatboy Oct 06 '14 at 06:51
  • May be 666 is enough? Also, it's better to change files owner (check web server user) – sectus Oct 06 '14 at 07:00
  • What security concerns? It seems that the default setting on your server prevents the web server from writing to a file. If you want to write, you obviously have to change these permissions. For a directory you'll need `777`, for files `666` shoudl suffice. – hanzi Oct 06 '14 at 07:01
  • Security concerns about everyone being able to put random files on your server... – LazyPeon Oct 06 '14 at 07:35
  • @LazyPeon I'm not downplaying risks of 777 permissions, but it's still a lot less of a concern compared to arbitrarily running code because of bad coding (which is often the case with PHP code). – Christian Oct 06 '14 at 07:49

1 Answers1

0

Generally you should only give the minimum amount of permissions required.

For files that need to be executable directories are commonly be set to 755 (drwxr-xr-x) or 750, and files 644 (-rw-r--r--). That's not to say that some environments don't have permissions that are often set much lower — it's dependent on which user and group owns the files or directories.

Upload directories sometimes need to be set at 777, although you really shouldn't be executing scripts from the same directory as where items are uploaded. The reason is that it can open a floodgate of possible attack vectors. If you need to execute something that might be uploaded, then you might consider mv or cp it into another directory, then execute it.

Joe Habadas
  • 628
  • 8
  • 21
  • My scripts and uploaded (public) files are in separate directories. What I am curious about is can setting 777 harm me in any way? Because on this particular server 755 returns error if I try to write files on it. – LazyPeon Oct 06 '14 at 07:51