15

对于我的 Web 应用程序，人们可以将图像从 Web 表单上传到我的 Web 服务器。

我应该为该图像上传目录设置 CHMOD 设置，以便人们可以将图像（从 Web 服务器）上传到该目录，但出于安全原因不能执行他们上传的任何文件。

chmod 设置会是什么？：

chmod 744 directory/
4

2 回答 2

22

There are two possible meanings for "executable" in this context, and both are things you need to configure against.

  1. An executable binary file that may run from the command line by typing the file's name into a shell

  2. A file that may be read and processed as script by a web server.

Handling binary-executable

To configure against case 1 on a un*x system, you need to ensure that your upload directory, and files therein, are owned by the web server user and only readable by that user. The directory must be executable; this means that the files inside that directory can be accessed). If the web user needs to list the files in the directory, it must also be readable. It, of course, must also be writable to allow new files to be created.

Thus the octal set you want would be 

chown <web-server-user> <upload-dir>
chmod 0700 <upload-dir>

The files must not be executable and should only be readable and writable by the web server,so these should be 

chmod 0600 <uploaded-file>

Please note that this means that only the web server user will be able to see these files. This is the best situation for security. However, if you really do need other local users to be able to see these files,then use

chmod 0755 <upload-dir>
chmod 0644 <uploaded-file>

Handling web-server excutable

Coding against case 2 is web server specific.

One option is to place the upload directory outside of the webroot, dissalowing direct URL access to the uploaded files completely and only to serve them via server-side code. Your code reads and echoes the file content, thus ensuring it is never processed as script by the web server

The other option is to configure your web server to not allow script processing of files in the upload directory. This configuration is web-server specific. However, for example, in Apache you can achieve this this by entering into your server configuration:

<Directory "path-to-upload-dir">
  AllowOverride None
  Options -ExecCGI
</Directory>

AllowOverride None is important, as it stops anyone uploading a .htaccess file to your uploads directory and re-configuring the web server permissions for that directory.

于 2009-05-06T08:51:39.933 回答
0

目录上的 chmod 无法做到这一点，而且无论模式是什么，您的 Web 服务器都可能将 .php 解释为可执行文件。您可能想要指定您正在使用的服务器，可能有一个 .htaccess 或类似的指令您可以使用。

请注意，目录上的“执行”意味着“可以访问目录中的文件”，因此如果您希望您的 Web 服务器可以访问其中的文件，则必须进行设置...

于 2009-05-06T05:54:28.830 回答