Index: [Article Count Order] [Thread]

Date:  Sun, 16 Jul 2006 12:47:58 +0200
From:  "=?ISO-8859-1?Q?Fran=E7ois_Serrault?=" <f.serrault (at mark) gmail.com>
Subject:  [coba-e:06031] Re: Image upload script failed
To:  coba-e (at mark) bluequartz.org
Message-Id:  <dd0512c70607160347r19532648laf1a444375d9a24f (at mark) mail.gmail.com>
In-Reply-To:  <Pine.LNX.4.63.0607131517270.18664 (at mark) mail.nuonce.net>
References:  <dd0512c70607130807o2fcfdc9eg190a3dc125434cf0 (at mark) mail.gmail.com>	 <Pine.LNX.4.63.0607131517270.18664 (at mark) mail.nuonce.net>
X-Mail-Count: 06031

Hi Brian,
Yes, it was a problem with my script permission.
It's solved now.

Thanks.

Dts1


2006/7/13, Brian N. Smith <brian (at mark) nuonce.net>:
>
> > I have a question.
> > I can't upload a file on my BQ with a simple form and a php script.
> > Maybe I have a problem with the temp file created.
> > I have protected the /tmp partition with Nuonce solution :
> >
> > -------------------------------------------
> >
> > /usr/bin/perl -pi -e "if (/\/tmp/) { s/defaults/noexec,nosuid,rw/ }" \
> > /etc/fstab
> > /bin/mount -o remount /tmp
> >
> > ----------------------------------------
> >
> > Is it possible that this protection lock the possibility to upload a
> file ?
> > Do you know where are uploaded files with a script ?
>
> What that does is to remove the ability for scripts to be executed in the
> /tmp partition.  Typically everyone has read/write/execute in that
> directory.  Which is kind of bad.
>
> If a script uploads a bot, it gets placed in that directory.  Then, the
> webserver can run it.  Well, using that fix, it removes the ability for it
> to be ran.  Which further protects you from kiddie scripters.
>
> The fact you can't upload a file is a permission's problem.  You can /tmp
> as a temporary holding directory, but the directory the file will actually
> be stored on needs to have write permissions for Apache (or siteadmin name
> if using CGI).
>
> Add some error checking into your script.  It will tell you why it isn't
> working.  But, (i may be wrong), I highly doubt it is because of the /tmp
> directory lacking exec on it.
>
> Thanks,
> Brian N. Smith
> NuOnce Networks, Inc.
>
>

	

6031_2.html (attatchment)