0

I'm with a web application that let anonymous users to upload images, transform them and get them later. I have a directory with www-data group owner and 1770 permissions, where the images are uploaded. In Apache configuration, AllowOverride set to none and Options to -Indexes. The input validation is controlled, so would be difficult to exploit. The question is:

How could anyone write files in that directory (if input validation is controlled), where Apache user has permissions to do it?

And what changes when the permissions are set to 777?

3
  • Somebody just using your web application is not a “user” from the perspective of your server.
    – CBroe
    Oct 23, 2013 at 10:34
  • @CBroe - What does it change?
    – Manolo
    Oct 23, 2013 at 12:07
  • The change is: it is NOT of interest in the files system perspective, so no need to play around with linux file system permissions, because it's ALLWAYS the apache user and group accessing the files. Nov 4, 2013 at 9:48

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.