Change permissions of file uploaded by PHP

Question

I have created a small scale CMS for a website I am working on and have a form that uploads image files to be used on the website. It uploads the files successfully but the permissions it sets do not allow the file to be viewed in a browser.

Here is my current PHP code to upload the files

$typepath = $_POST['filetype'];

$target_path = "../../images/uploads/".$typepath."/";

$target_path = $target_path . basename( $_FILES['uploadedfile']['name']); 

if(move_uploaded_file($_FILES['uploadedfile']['tmp_name'], $target_path)) {
    echo "<p>The file ".  basename( $_FILES['uploadedfile']['name']). 
    " has been uploaded</p>\n<p>To the directory:  <span style=\"font-weight:bold;\">".substr($target_path, 6)."</span></p>";
} else{
    echo "There was an error uploading the file, please try again!";
}

Browser has nothing to do with file permissions. Can you please tell more real story, preferably with copy-pasted error messages? Thanks — Your Common Sense, Jan 17 '11 at 15:27
@Col. Shrapnel - yes it does. If the file doesn't have read permissions on the server, then the browser will get a `401 not authorised` error. — Spudley, Jan 17 '11 at 15:31
@Spudley it's 403. And it's still **server** issue, not browser one. — Your Common Sense, Jan 17 '11 at 15:40

score 25 · Accepted Answer · answered Jan 17 '11 at 15:28

25

PHP Manaual chmod http://php.net/manual/en/function.chmod.php

chmod("/somedir/somefile", 0755);

In context;

$typepath = $_POST['filetype'];

$target_path = "../../images/uploads/".$typepath."/";

$target_path = $target_path . basename( $_FILES['uploadedfile']['name']); 

if(move_uploaded_file($_FILES['uploadedfile']['tmp_name'], $target_path)) {
    chmod($target_path, 0755);
    echo "<p>The file ".  basename( $_FILES['uploadedfile']['name']). 
    " has been uploaded</p>\n<p>To the directory:  <span style=\"font-weight:bold;\">".substr($target_path, 6)."</span></p>";
} else{
    echo "There was an error uploading the file, please try again!";
}

answered Jan 17 '11 at 15:28

Matt Lowden

2,586
17
19

2

Be advised though: using chmod 755 means that the owner can read, write and execute. The group can now read and write. "Other" (anyone else) can read and write. Now, I assume that people won't be able to get into the directory, but if so, they could inject harmful stuff in your files. I'd always go for chmod 750 instead. – Berry Langerak Jan 17 '11 at 15:33
@Max Can you delete the files if you're using 644? Dont you need "execute" permission for that? – StefanNch May 09 '14 at 08:11
Will it set permissions for all users? – Adil Malik Feb 13 '15 at 18:17

Change permissions of file uploaded by PHP

1 Answers1

Linked