转移到新的主机/服务器 - fopen（）和fwrite（）[重复]的权限问题

Question

Possible Duplicate:
mysql_fetch_array() expects parameter 1 to be resource, boolean given in select

When users register an account, their profile is supposed to be automatically created using fopen(), like so:

$fh = fopen($profile_path.$username_file.'.php', "w");
fwrite($fh, $tpl_and_values);
fclose($fh); 

The first parameter for fopen(), when the variable values are given, should be something like this: profile/Auser.php. $tpl_and_values just gives the path to the template file.

Here are the errors I'm getting:

Warning: fopen(profile/givenusername.php) [function.fopen]: failed to open stream: Permission denied in /f5/tagzor/public/registeraccount.php on line 109

Warning: fwrite() expects parameter 1 to be resource, boolean given in /f5/tagzor/public/registeraccount.php on line 110

Warning: fclose() expects parameter 1 to be resource, boolean given in /f5/tagzor/public/registeraccount.php on line 111

(Registeraccount.php is the page where the code above resides.)

I'm thinking it has to be some kind of CHMOD permissions problem. Registeraccount.php is set to 655, so I don't really know what could be wrong. Giving it 777 might be a bad idea, but I could be wrong.

Answer 1

Your question implies quite a few security issues.

E.g. I hope you're sanitizing your data - what if a user registers as "../index".

However..

---

The permissions of Registeraccount.php are not relevant to the error you see.

Assuming that $fh = fopen($profile_path.$username_file.'.php', "w"); is line 109 of your script:

You need to ensure that $profile_path is writable. As a start make /f5/tagzor/public/profile world writable (777)

You should find the error goes away. If you don't change the owner of that folder most likely the permissions need to remain 777, if possible though:

• Change the owner of the profile folder to the user running php (check the owner of the files in that folder)
• Set permissions to 755

That will at least restrict such that only the webserver user is able to create files in that folder.