0

I got here from StackOverflow because I couldn't find a solution there. Here is the link to the question.

When I open terminal and type whoami I get m1ck0 which is my user. But when I enter whoami command in PHP

echo exec('whoami');

I get http and this is causing me the problem where I can't make image upload with PHP. It says

Warning: move_uploaded_file(../../images/cart.png): failed to open stream: Permission denied in /srv/http/portfolio/admin/backend/write/blogs.php

I think that this is because I don't have ownership of that folder. But output of ls -l is

drwxr-xr-x 9 m1ck0 m1ck0 4096 13. nov. at 21:18 portfolio

for the root directory of project and

drwxr-xr-x 2 m1ck0 m1ck0 4096 13. nov. at 21:18 images

for a directory where I want to upload the image to.

Thank you in advance :)

UPDATE

I also tried with an absolute path to the directory and still got the same error.

UPDATE 2 I am using OS: Manjaro Linux x86_64

  • 3
    Do you really enter the command in PHP, or are you executing it from a script in a web page? It is normal for a web server to run as user http. – AlexP Dec 4 '19 at 12:48
  • I am executing it from a PHP script right before I try to move a file to desired folder – Mileta Dulovic Dec 4 '19 at 12:49
  • 1
    Well, the HTTP server (Apache HTTP Server, Nginx) is not you. You could configure it to run under your user account, but that would be both insecure and unusual. You must develop your application taking into consideration that the web server runs under a dedicated service account. – AlexP Dec 4 '19 at 12:51
  • Any tips or links that you can point me to? – Mileta Dulovic Dec 4 '19 at 12:54
  • If you are using Apache HTTP Server, you could start with Ivan Ristić's Apache security; it is an (old and) gentle introduction to the topic. Once you make sure that you understand that little book many things will become more clear. – AlexP Dec 4 '19 at 13:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.