views:

80

answers:

2

Figured PHP's rename would be my best bet. I didn't see many examples on how to use relative URLs in it though, so I kind of compromised. Either way, this give me permission denied:

I want to do this:

$file = "../data.csv";
rename("$file", "../history/newname.csv");

Where ../ of course would go back 1 directory from where the script is being ran. I couldn't figure out a way...so I did this instead:

$file = "data.csv";
$path = dirname(realpath("../".$file));
rename("$path/$file", "$path/history/newname.csv");

However I am getting permission denied (yes the history folder is owned by www-data, and yes data.csv is owned by www-data). I thought it was weird so I tried a simple test:

rename( 'tempfile.txt', 'tempfile2.txt' );

and I made sure www-data had full control over tempfile.txt...still got permission denied. Why? does the file your renaming it to have to exist? can you not rename like linux's mv? So I instead just copy() and unlink()?

A: 

Not only ownership plays a role, but also file permissions. Make sure that the permissions are set up correctly on the source file and destination directory (e.g. chmod 644 data.csv).

Is www-data the same user as Apache?

Edit: Take care to provide existing, absolute paths to realpath(). Also beware of the following:

$path = dirname(realpath("../".$file));

This might yield nothing, because the file ../data.csv might not exist. I.e., the result of realpath() on a non-existent file is false.

Here's some code that might work better for you:

$file = "data.csv";
$path1 = realpath($file);
$path2 = realpath(dirname($file).'/..').'/history/newname.csv';
rename($path1, $path2);

You should be extremely careful that $file cannot be edited by the visitor, because he could change a request manipulate which file is renamed to where.

Paul Lammertsma
Actually `644` would be better, since a CSV file shouldn't be executable.
David Zaslavsky
yes the chmod is 644, I even tried 777 to get it to work. Nothing is working. and apache is www-data, I know this because I move other stuff around and needed it to be www-data, plus I checked top.
BHare
The full path to data.csv would be /var/imvu/products/ht/clients/test/data.csv where /var/ is owned by root, imvu through test is owned by wwwftp (an ftp i made so I dont ftp into root). Also like I said, the dir where its going (history) is owned by www-data.
BHare
Could it be that the file is in use? Can you rename it as administrator?
Paul Lammertsma
It could of been that, but the test file i made, tempfile.txt was just created by me in root (never opened by anything) , in which i then chmod to 777 and then chowned to www-data...still wont rename.
BHare
Is there any security features that could be turned on by default or by accident?
BHare
Please review my edit.
Paul Lammertsma
+2  A: 

In order to move a file from "../" to "../history/", a process needs write permission to both "../" and "../history/".

In your example, you're obviously lacking write permission to "../". Permissions for the file being moved are not relevant, by the way.

Marc Donges