转移到新的主机/服务器 - fopen()和fwrite()[重复]的权限问题

Possible Duplicate:
mysql_fetch_array() expects parameter 1 to be resource, boolean given in select

When users register an account, their profile is supposed to be automatically created using fopen(), like so:

$fh = fopen($profile_path.$username_file.'.php', "w");
fwrite($fh, $tpl_and_values);
fclose($fh); 

The first parameter for fopen(), when the variable values are given, should be something like this: profile/Auser.php. $tpl_and_values just gives the path to the template file.

Here are the errors I'm getting:

Warning: fopen(profile/givenusername.php) [function.fopen]: failed to open stream: Permission denied in /f5/tagzor/public/registeraccount.php on line 109

Warning: fwrite() expects parameter 1 to be resource, boolean given in /f5/tagzor/public/registeraccount.php on line 110

Warning: fclose() expects parameter 1 to be resource, boolean given in /f5/tagzor/public/registeraccount.php on line 111

(Registeraccount.php is the page where the code above resides.)

I'm thinking it has to be some kind of CHMOD permissions problem. Registeraccount.php is set to 655, so I don't really know what could be wrong. Giving it 777 might be a bad idea, but I could be wrong.

Your question implies quite a few security issues.

E.g. I hope you're sanitizing your data - what if a user registers as "../index".

However..


The permissions of Registeraccount.php are not relevant to the error you see.

Assuming that $fh = fopen($profile_path.$username_file.'.php', "w"); is line 109 of your script:

You need to ensure that $profile_path is writable. As a start make /f5/tagzor/public/profile world writable (777)

You should find the error goes away. If you don't change the owner of that folder most likely the permissions need to remain 777, if possible though:

  • Change the owner of the profile folder to the user running php (check the owner of the files in that folder)
  • Set permissions to 755

That will at least restrict such that only the webserver user is able to create files in that folder.

Registeraccount.php may be 655 now (actually, it should probably be 644*), but it is the file's ownership that will matter here. It needs to be writable by the web server user (www-data, apache, whatever the user is). So if the file is not owned by that user, it will need to have its ownership or group changed to that user.

If it is changed to group ownership by the web server user, then set permissions to 664.

# Set group ownership to the web server user
chown currentuser.apache Registeraccount.php

# Set write permissions for the group
chmod 664 RegisterAccount.php

* Regarding 655 - that would indicate the file is executable by its group and other non-owners. Most likely you don't want this to be executable, so 644 is the appropriate permission: read/write by the file owner, read-only by the group and others.