SRL Archive - Web Development

Hello SRL

i have a bit of a problem while making Alfrescode

i need to limit access to the files which PHP can access

i found this
open_basedir = /var/www/htdocs/files
however i want the people to only access files in their folders not one main folder

for example, there are three folder for each user
each user can access the files in their folder, but they cannot access files in each others folder

how can i do this, i tried google but couldnt find anything :/

~shut

Couldn't you create a folder with the persons username on the fly? Then, create the sub folders in there. Then do something like open_basedir = /var/www/htdocs/$username/ this?

a .htaccess file to hide all other files from that users php / apache besides his own? something like that.. I saw it setup before

From: Kyle Undefined
Couldn't you create a folder with the persons username on the fly? Then, create the sub folders in there. Then do something like open_basedir = /var/www/htdocs/$username/ this?

good idea, then put it in a .htaccess file which they cant edit
correct?

~shut

Right :D

yea sounds like it, I was googling about it.. I don't know that stuff as well as you probably do

I saw someone set it up in a php class before, was over my head at the time.. now I actually know about it lol, so I have to go back on what I remember which isn't much

Instead of doing poor "fixes" with your httpd, fix up the base of the code. Why are users able to change the directory to begin with? That itself is a huge security vulnerability that you should fix.

Don't use PHP? Other than that, do what Harry said^

From: Harry
Instead of doing poor "fixes" with your httpd, fix up the base of the code. Why are users able to change the directory to begin with? That itself is a huge security vulnerability that you should fix.

oh i think you misunderstood me

when the user signs up a subdirectory will be created, this is their folder where they can create and edit files, they can only view and edit these files through the website and they can only access their files within their directory

i wanted to prevent php from accessing files from other directories

what Kyle said worked perfectly

~shut

From: Shuttleu
oh i think you misunderstood me

when the user signs up a subdirectory will be created, this is their folder where they can create and edit files, they can only view and edit these files through the website and they can only access their files within their directory

i wanted to prevent php from accessing files from other directories

what Kyle said worked perfectly

~shut

isn't that what chroot is for?