0

I'm working on a site where a user can upload their resume. I created this folder above root for security. When the user submits the form, the attached file uploads to the "secure" folder without issue (I can see it). However, when I go to the Forms module and look at the submissions, clicking on the file gives me an error that "The page you requested was not found."

Not sure if this is normal for files stored above root or if I have a path messed up?

Thanks in advance!

Todd

1

It seems your web user (whatever user the website executes under) does not have permission to get outside the root directory. This is normal as this way the website (or code executed by the website) can't escape its root (look into open_basedir).

This or the file uploaded does not grant the right permissions when copied from the server temp to the uplaod directory. Can you elaborate on the file and folder permissions (owner and group too) for the directory outsdie of the root? It could be the file is added as root or some other priviledged user, so you can see the files with your root user but the websie user can't...

One thing you can do, that Ive done before to handle this sort of thing (importing SFTP uploads under a different domain but not allowing the website to be able to access the other domain), is to set up a SymLink within the root directory. you can then access that directory as a child of the root directory, as long as the destination dir has permission granted for the web user. This would defeat the object though.

Coming to it, what is your objective? You mention storing uploaded files outside of root for security, however you want the web user to uplaod to this directory, and be able to read this directory (so you can browse the file in the CP). In other words you want the web user to be able to access it but not access it...

Edit 1 Following sicussion a few more things to try

Thinking about this, there's a couple of things you can try to drill down the issue :

  1. Try accessing the file using a relative path This is simple, pop a text folder in the 'secret' directory and write a simpel PHP script to read and display the text file. If PHP can read and display it then yes the web user can read the secret folder.

    1a. Assuming the web user can access the file, check your path's as it's most likely this is fudged.

    1b. Assuming the web user can not access the text file, this indicates that in fact there is a security measure in place stopping the user from excaping the root, double check bopen_basedir settings (check vhosts too), also check your web site management software (for instance plesk enforces root directory encapsulisation regardless)

  2. How do we allow access for web user when via the EE CP, but deny other requests? https://stackoverflow.com/questions/2679524/block-direct-access-to-a-file-over-http-but-allow-php-script-access Basically, assuming we can get the web user accessing the file, we then drop a /htaccess into the uploads directory that deny's access, becuase the web user execuse script on the server on the local file system it should still be able to reach the files, however a direct (URL based) access will be denied by the .htaccess policy

In short, the fact that your web user can not access the files indicates there is some security somewhere blocking you, once w work out where this is and defeat it we can then look to guard against direct access. Note you _could_apply this principle inside the root directory, so that htaccess blocks direct/link/URL access to the file but the web user/PHP can reach it.

| improve this answer | |
  • OK, I see the confusion so let's see if I can clear it up. The visitor is submitting their resume via the form. It gets uploaded to a location on the server, and I don't want those files accessible via the general web user. So I put the folder above root. The file is getting uploaded as I can see it via the file browser. However, when the admin views the entries via the Forms CP, the link to the file is giving him the error. I'm not sure if it's the way I have something configured or what. open_basedir is off/empty, and the permissions on the folder are currently 777. – Todd Jun 5 '15 at 15:28
  • Thats the problem, you state you don't want the web user to access the files, however you then ssay an admin logged into EE can't view the files, in order for the admin CP to see the files (remembering Admin CP PHP is executed with the web user) the web user must be able to access the files. Anyway, try this guide : nicolasbottari.com/blog/… it describes the setup but doesn't touch on the display of said files in CP... – Blatant Jun 5 '15 at 16:13
  • OH, also this : ellislab.com/forums/viewthread/211934/#983496 it deals with runing EE outsode of root but the permission priciples might be of assistance – Blatant Jun 5 '15 at 16:14
1

This might be a file/directory ownership issue. Depending on what kind of host/server you're on, the system "root" user might actually be the owner of all the files in web root.

For a lot of stuff this is fine, but occasionally, EE will choke on something unless it's owned by the web user.

Note, by 'web user' I'm not referring to the 'person uploading the document to your site'. The 'web user' is basically the account that runs web stuff like ExpressionEngine. When your 'website user' is using your website, EE is running under the 'web user' account on the system.

So if the files that EE needs to access are owned by "root", then PHP processes (which runs as the web user) cannot do certain things, even if the files have 777 permissions.

So you need to use the chown command to change the owner on any files in web root, and any files above webroot that EE needs to access.

DO NOT DO THIS, THIS IS AN EXAMPLE

On Ubuntu, the web user is www-data. When I need to change the owner of a directory on my server, I cd to the correct directory and type:

chown -R www-data:www-data ./*

This tells the server to change the owner of everything in this directory to the web user.

Once again, do not type that verbatim, you need to replace www-data with the name of the web user for your server.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.