1

I am using php5.3 on Linux and trying to make it so a user can upload content into a folder based on their username. I have the code for the folder working well. The problem is the upload is working correctly when the folder is static-named (target = "uploads/", for example), but as soon as I change it to 

$username = $_POST['username']; 
$target = "$username/";

I get the errors

Warning: move_uploaded_file(/bluecheck.jpg) [function.move-uploaded-file]: failed to open stream: Permission denied in /home/content/14/6467414/html/upub/upload.php on line 17

Warning: move_uploaded_file() [function.move-uploaded-file]: Unable to move '/home/content/14/6467414/tmp/phpxLCQK2' to '/bluecheck.jpg' in /home/content/14/6467414/html/upub/upload.php on line 17
Sorry, there was a problem uploading your file.

The folder has Write permission and I have a startsession and am able to echo the $username on the page so I do not think it has anything to do there.

Here is the full code I have:

<?php 

   // This is the startsession I am using.
  if (!isset($_SESSION['user_id'])) {
if (isset($_COOKIE['user_id']) && isset($_COOKIE['username'])) {
  $_SESSION['user_id'] = $_COOKIE['user_id'];
  $_SESSION['username'] = $_COOKIE['username'];
    }
  }


$username = $_POST['username']; 

$target = "$username/";  $target = $target . basename( $_FILES['uploaded']['name']) ;  $ok=1;   

//size condition  
if ($uploaded_size > 350000000)  {  echo "Your file is too large.<br>";  $ok=0;  }   

//file type condition  
if ($uploaded_type =="text/php")  {  echo "No PHP files<br>";  $ok=0;  }   

//check that $ok was not set to 0 by an error  
if ($ok==0)  {  Echo "Sorry your file was not uploaded";  }   

//If everything is ok, try to upload it  
else  {  if(move_uploaded_file($_FILES['uploaded']['tmp_name'], $target))  {      echo "The file ". basename( $_FILES['uploadedfile']['name']). " has been     uploaded";  }  else  {  echo "Sorry, there was a problem uploading your file.";  }  }  ?>

I would really appreciate any thoughts.

brtedesco
  • 11
  • 2
  • Do **NOT** do that. you're opening your system to a COMPLETE remote compromise by directly using **USER-PROVIDED** data. They can specify the full path and filename and cause your code to dump a file ANYWHERE on your system. – Marc B Sep 21 '16 at 21:08
  • OK. I knew there were some security issues I would have to address, but I guess I under-estimated them. So I guess I will move to my second option of just having them email files. Unless there is a better solution out there.... – brtedesco Sep 21 '16 at 21:24
  • Possible duplicate of [PHP - Failed to open stream : No such file or directory](http://stackoverflow.com/questions/36577020/php-failed-to-open-stream-no-such-file-or-directory) – Vic Seedoubleyew Sep 22 '16 at 07:38

0 Answers0