Linux PHP创建文件权限被拒绝

Question

I am working on Ubuntu and trying to get a PHP script working that will allow the user to input a Youtube video URL, and the script will download the flv and convert it using youtube2mp3 (which I found here: http://hubpages.com/hub/Youtube-to-MP3-on-Ubuntu-Linux ). I have been getting errors which I'm sure are permissions based, and I would like to know the best and most secure way to correct them. Right now I'm calling

echo system("youtube-dl --output=testfile.flv --format=18 $url");

just to try and get the downloading portion working. What shows up on the following page is

[youtube] Setting language
[youtube] xOMEi2g_oEU: Downloading video webpage
[youtube] xOMEi2g_oEU: Downloading video info webpage
[youtube] xOMEi2g_oEU: Extracting video information
[youtube] xOMEi2g_oEU: Extracting video information

before showing the rest of my (irrelevant) output. In the apache error log, I'm getting

ERROR: unable to open for writing: [Errno 13]
    Permission denied: u'testfile.flv.part'

which is obviously indicative of a permissions issue. Do I have to chown the directory in question to www-user? Is that secure? Or should I chmod the directory instead? Eventually I will be putting this on a public facing server and I don't want any vulnerabilities in my implementation. Any and all advice and answers are greatly appreciated!

Answer 1

This is running as the user running the php process so two things:

1. Make sure this user has access to the directory you are writing your testfile out to. I would specify a path that is isolated and not part of the web server directory structure which it appears to be doing now
2. Is $url coming from user input? If it is I would then use escapeshellcmd on the entire string to ensure there isn't the random rm -rf * command in there.