【问题标题】:Permission level in apacheapache中的权限级别
【发布时间】:2015-05-07 17:38:09
【问题描述】:

我正在为我的部门开发一个网站。我在 Ubuntu 中使用临时服务器 apache。我在访问文件夹中的文件时遇到了麻烦。我有这样的情况,我将上传一张照片,它将存储在文件夹 /var/www/web/uploads 中,其路径存储在 mysql php 数据库中。我将路径保存在数据库和上述文件夹中没有问题,但是当我尝试在网站中显示时,我无法访问它。它说我不是所有者。它显示 www-data 作为所有者。我知道我应该更改终端中的权限级别。我尽了最大努力,但没有得到丰硕的成果。任何人都可以帮助我如何更改其权限级别。

//这是html代码indeximg.php

  <html> 
  <head>
  <title>File Upload with PHP</title>
  <link href="styleimg.css" rel="stylesheet" type="text/css" />
  </head>
  <body>
  <div id="theForm">
  <form action="uploader.php" enctype="multipart/form-data" method="post" >
  <label>Title
  <span class="small">Title of the File</span>
  </label>
  <input type="text" name="mName" id="mName" />
  <label>File
  <span class="small">Choose a File</span>
  </label>
  <input type="file" name="mFile" id="mFile" />
  <button type="submit" class="red-button" id="sendmail">Upload (<?php echo ini_get('upload_max_filesize').'B'; ?>)</button>
  <div class="spacer"></div>
  </form>
  </div>
  </body>
  </html>

// 这是文件上传加载器代码

  // replace with your mysql database details
  $MySql_username   = "shwetharao"; //mysql username
  $MySql_password   = "shwetha"; //mysql password
  $MySql_hostname   = "localhost"; //hostname
  $MySql_databasename = 'semilab'; //databasename
  if (!@file_exists($UploadDirectory)) {
  //destination folder does not exist
  die("Make sure Upload directory exist!");
  }

  if($_POST)
  { 
  if(!isset($_POST['mName']) || strlen($_POST['mName'])<1)
  {
    //required variables are empty
    die("Title is empty!");
   }


   if($_FILES['mFile']['error'])
   {
    //File upload error encountered
    die(upload_errors($_FILES['mFile']['error']));
   }

   $FileName            = strtolower($_FILES['mFile']['name']); //uploaded file name
   $FileTitle           = mysql_real_escape_string($_POST['mName']); // file title
   $ImageExt            = substr($FileName, strrpos($FileName, '.')); //file extension
   $FileType            = $_FILES['mFile']['type']; //file type
   $FileSize            = $_FILES['mFile']["size"]; //file size
   $RandNumber          = rand(0, 9999999999); //Random number to make each filename unique.
   $uploaded_date       = date("Y-m-d H:i:s");

   switch(strtolower($FileType))
   {
    //allowed file types
    case 'image/png': //png file
    case 'image/gif': //gif file 
    case 'image/jpeg': //jpeg file
    case 'application/pdf': //PDF file
    case 'application/msword': //ms word file
    case 'application/vnd.ms-excel': //ms excel file
    case 'application/x-zip-compressed': //zip file
    case 'text/plain': //text file
    case 'text/html': //html file
        break;
    default:
        die('Unsupported File!'); //output error
    }


//File Title will be used as new File name
  $NewFileName = preg_replace(array('/\s/', '/\.[\.]+/', '/[^\w_\.\-]/'),  array('_', '.', ''), strtolower($FileTitle));
  $NewFileName = $NewFileName.'_'.$RandNumber.$ImageExt;
  $UploadDirectory  = "/var/www/web/".$NewFileName;
  echo $UploadDirectory;

  //Rename and save uploded file to destination folder.
  if(move_uploaded_file($_FILES['mFile']["tmp_name"], $UploadDirectory))
  {
    //connect & insert file record in database
    $dbconn = mysql_connect($MySql_hostname, $MySql_username,    $MySql_password)or die("Unable to connect to MySQL");
    mysql_select_db($MySql_databasename,$dbconn);
    @mysql_query("INSERT INTO file_recordimg (file_name, file_title, file_size, uploaded_date , uploaded_path) VALUES ('$NewFileName', '$FileTitle',$FileSize,'$uploaded_date','$UploadDirectory')");
    mysql_close($dbconn);

    header('Location: '.$SuccessRedirect); //redirect user after success

   }else{
    die('error uploading File!');
   }
  }

  //function outputs upload error messages, http://www.php.net/manual/en/features.file-upload.errors.php#90522
 function upload_errors($err_code) {
 switch ($err_code) { 
 case UPLOAD_ERR_INI_SIZE: 
  return 'The uploaded file exceeds the upload_max_filesize directive in php.ini'; 
    case UPLOAD_ERR_FORM_SIZE: 
        return 'The uploaded file exceeds the MAX_FILE_SIZE directive that was specified in the HTML form'; 
    case UPLOAD_ERR_PARTIAL: 
        return 'The uploaded file was only partially uploaded'; 
    case UPLOAD_ERR_NO_FILE: 
        return 'No file was uploaded'; 
    case UPLOAD_ERR_NO_TMP_DIR: 
        return 'Missing a temporary folder'; 
    case UPLOAD_ERR_CANT_WRITE: 
        return 'Failed to write file to disk'; 
    case UPLOAD_ERR_EXTENSION: 
        return 'File upload stopped by extension'; 
    default: 
        return 'Unknown upload error'; 
   } 
   } 
   ?>

/// 输出

 <?php

  $MySql_username   = "shwetharao"; //mysql username
  $MySql_password   = "shwetha"; //mysql password
  $MySql_hostname   = "localhost"; //hostname
  $MySql_databasename = 'semilab'; //databasename

  $dbconn = mysql_connect($MySql_hostname, $MySql_username,    $MySql_password)or die("Unable to connect to MySQL");
    mysql_select_db($MySql_databasename,$dbconn);
    $sql = 'SELECT uploaded_path
    FROM file_recordimg';

  $retval = mysql_query( $sql, $dbconn );
  if(! $retval )
  {
  die('Could not get data: ' . mysql_error());
  }
  while($row = mysql_fetch_array($retval, MYSQL_ASSOC))
  {
   echo "$row[uploaded_path]";
   ?>
   <table style="border-collapse: collapse; font: 12px Tahoma;" border="1">
    <tbody><tr>
   <td>
   <img src="<?php echo $row[uploaded_path];?>">

    </td>
    </tr>
    </tbody></table>


    <div align="center"><strong>Success.. File uploaded!</strong></div>
    <?php
    }
    mysql_close($dbconn);

     ?>

【问题讨论】:

  • 可以给我们看代码吗??
  • 你能以 www.appname.com/uploads 的身份访问 images 文件夹吗?
  • 什么时候说你不是所有者?
  • 从前端获取图像并上传到“uploads”文件夹。但是图像被锁定。当我单击属性-> 权限(图像)时,它将所有者显示为 www-data。它表明我不是上传文件的所有者。但在 /var/www/web/uploads 之前,我可以访问文件夹。

标签: php mysql apache web file-permissions


【解决方案1】:

试试这个

在 linux 服务器上以 root 用户身份登录。转到您的上传文件夹并授予 777 上传文件夹的权限,然后重试

【讨论】:

  • 如何以root身份登录?我是这个 linux 服务器的新手
  • 是的,是的,滥用根权限并授予每个人写入权限...是的,是的。其实不要这样做。这是最糟糕的解决方案。问题出在其他地方。这是一个巨大的安全风险。如果有人可以劫持您的系统或恶意 php 脚本,他们可以上传/创建 .sh 文件、安装恶意内容并从那里正确劫持您的服务器。真的......不要在文件夹上这样做。
猜你喜欢
  • 1970-01-01
  • 1970-01-01
  • 2012-05-17
  • 2012-12-03
  • 1970-01-01
  • 2017-06-14
  • 1970-01-01
  • 2012-05-26
  • 1970-01-01
相关资源
最近更新 更多