Linux Apache/PHP File upload: move_uploaded_file issues error

Question

I have set up an apache2 webserver on a Debian Jessie machine. I am uploading files to the server using a PHP script, following http://php.net/manual/en/function.move-uploaded-file.php .

I have set up /etc/php/apache/php.ini to enable file uploads, and I can upload a file fine.

I want the uploaded files to have the permissions set as 0664. Having read around on Stack Overflow, in /etc/apache2/envvars I have done

umask 002

which I believe should set the PHP interpreter umask to be derived from apache, i.e. 002.

The file upload directory ownership and permissions are set to www-data:www-data 770 (i.e. the apache user).

However, when I move the temporary PHP file to the upload directory using move_uploaded_file, the file permissions are 600, i.e. group permissions are not preserved.

Can anyone provide any ideas as to what might be wrong?

Following comments below, I should have stated that I want the moved file to have 0664 permissions.

I also tried this:

chmod($_FILES['file']['tmp_name'], 0664);
rename($_FILES['file']['tmp_name'], $new_filename);

And this:

chmod($_FILES['file']['tmp_name'], 0664);
copy($_FILES['file']['tmp_name'], $new_filename);

But this didn't work, I still get 0600 in both cases for the moved file.

Answer 1

move_uploaded-file always set permission to 600 for any uploaded file whatever configuration set in apache umask. you can use chmod in context with your code while uploading file and set permission.

chmod($target_path, 0664);

http://php.net/manual/en/function.move-uploaded-file.php In the comment section another users have same issue so they are describing same thing.

Answer 2

I don't know what might be wrong with your attempt, but you could use php's chmod function right after you moved your uploaded file.

Example:

$destination = '/absolute/path/to/upload/' . $filename;

if (move_uploaded_file($filename, $destination)) {
    chmod($destination, 0664);
}

EDIT

Use chmod() after using move_uploaded_file() and as in my example above use the same $destination variable for move_uploaded_file()'s second parameter and chmod()'s first parameter.

Answer 3

As sahil kataria correctly points out, move_uploaded_file forces the destination file permissions to 0600.

I needed 0660 permissions for the file in the directory when I wanted it to land. The workaround I ended up using was to

rename($_FILES['file']['tmp_name'], $another_temporary_file);
chmod($another_temporary_file, 0660);
rename($another_temporary_file, $final_destination_file);

This forces the permissions as I wanted and preserves them upon moving the file to its end destination.

To utilise the security features of move_uploaded_file, I could use that function in the first rename call in the code above.