Posted by frizzle on 04/05/06 01:10

Hi,

I am at the base of an FTP thingy i'm building, and i noticed that
it would only work if i chmod the folder 777, i thought to remember
correctly that previously on another site chmod 744 was enough,
now it isn't.
Am i mistaking, and should it always be 777 ? And isn't a chmodded
777 folder much more vulnerable?

Frizzle.


Code sofar below:


++++++++++++++++++++++++++
<?php

require_once('../inc/globals.php');

if( isset( $_FILES['image'] ) ){

$ftp_conn = @ftp_connect( $default_ftp_server )or
die('<b>Error!</b>');
@ftp_login( $ftp_conn, $default_ftp_user, $default_ftp_pass )or
die('<bError!</b>');

$uploaddir = '../items/';
$uploadfile = $uploaddir . basename( $_FILES['image']['name'] );

if ( move_uploaded_file( $_FILES['image']['tmp_name'], $uploadfile ) ){
echo "File is valid, and was successfully uploaded.";
} else {
echo "Possible file upload attack!";
};

ftp_close( $ftp_conn );

};

?>
<form action="<?php echo $PHP_SELF; ?>" method="post"
enctype="multipart/form-data" name="images" target="_top" id="images"
class="form">
<input name="image" type="file" id="image">
<br>
<input type="submit" name="upload" id="upload" value="Upload">
<input name="cancel" type="button" id="cancel" value="Cancel"
onClick="javascript:history.go(-1) ">
</form><?php

if (is_dir($uploaddir)) {
if ($dh = opendir($uploaddir)) {
while (($file = readdir($dh)) !== false) {
if ($file !== '..' && $file !== '.') echo "filename: $file :
filetype: " . filetype($uploaddir . $file) . "<br>\r\n";
}
closedir($dh);
}
};

?>
----------------------------------------------------

[Back to original message]