Folder permissions and security

[Thank The Cheese]

Good afternoon,
I'm working on an online newspaper website. I've created a page that allows an authorised person to upload a file to the server (ie. add a new article). To achieve this, I had to change the folder permissions to allow read and write privilages. I'm just wondering what sort of security hazards this allows.

The upload page itself will be password-protected so only authorised people can fill it out and upload a file, but does changing the permissions of a folder leave it open to people to take advantage of in other ways, without the use of the upload page?

I guess what I'm really asking is, is the way I've set this up a perfectly legitimate way of solving the problem, or is it a sloppy way of doing it (and there are better ways)?

Thanks for the help

 

[billbaloney]

The generally accepted way to do this involves first making sure that the web server process (e.g., httpd) is owned by a non-root user. If that's the case, you can make your upload storage directory writable by the web server process owner.

That way you can keep the directory at something like 755, i.e., not world writable. You should also consider whether you want to keep the directory outside the web root, so uploaded files aren't at all available to web browsers.