CGI/PHP interaction, security concern?

[BlueNoteWeb]

On the site that I'm currently building, I have to upload files using a CGI script and then manipulate them with a PHP script. That was a great source of frustration to me for several days. I've finally found the solution to the permissions problem, but I'm a bit worried about the security aspect and about how to properly configure DA to work with this. Any advice would be greatly appreciated. The flow goes something like this:

-PHP script creates a form, user fills in the form, including a file to be uploaded. Form submits to a CGI script.
-CGI script accepts the form information, saves the files to /tmp/, passes all information about the saved files to a second PHP script
-that PHP script verifies that the files are actually what they say they are (images and/or MP3s), deleting them if they are invalid/corrupted/script kiddies. PHP script then copies them to the proper locations in the user's home directory and updates the database appropriately

The problem was that the CGI created the files owned by the user, but PHP was running as Apache and could not do anything with those files in the tmp directory. I solved this by adding these lines to that user's httpd.conf:
User apache
Group apache

Now the CGI script runs as apache rather than that user. The PHP script can then access and modify the created files.

The biggest question for the DA community, how do I keep those lines in that user's httpd.conf? I tried inserting them through the DA admin interface, but the DA interface added a second set of user and group lines with that user's username. The second set apparently overrode the first set because it did not work. If that httpd.conf file is overwritten the site will break.

This server will have several different sites on it, but they're all owned by the same guy. It's not a shared hosting environment so I'm not worried about other users being able to access those tmp files. Are there other security concerns involved with running CGI scripts as the apache user? Is it possible to run only certain CGI scripts as the apache user, perhaps? Am I going about this all the wrong way? I do have full root access to the server so I can make whatever configuration changes need to be made.

Yes, the obvious answer is to use either all CGI or all PHP. These particular CGI scripts are written in Perl and display a status bar for the upload. My knowledge of Perl is very limited and I don't have time to learn before the deadline on this project, PHP does not have the functions to create that status bar. Everything else about the site is already coded in PHP (which I know much better than I know Perl). If someone has an alternate suggestion of how to handle that I'm all ears.

Thanks in advance, I appreciate any advice you have to offer.

 

[nobaloney]

If you chattr the file immutable DA won't be able to overwrite it. man chattr should tell you how to do it.

As I was reading your post I was thinking that sites such as these shouldn't be on a shared server. Glad to see it's shared only by the same site-owner.

The problem is that files owned by apache can be maniupulated by anyone in the world through apache. It's your job to keep that from happening.

Do both cgi and php have to write? If not perhaps you can write the files as owner apache, group siteowner, with the appropriate rights for read and write. You'll have to put them somewhere besides /tmp and set a mask so they'll be created the way you want them to be created.

Jeff

 

[sullise]

I'd stick with straight PHP for the upload and scrap the CGI mix. Not only does it present the obvious security concerns, it's a kludge.

You can do a status bar with PHP, just not on the same form as he upload...you need to do it in a popup...

Here's a great example with downloadable code..

http://www.raditha.com/php/progress.php

 

[BlueNoteWeb]

That's exactly the script I'm using. Some quotes from the page you linked to:

It took me five years to figure out something that PHP cannot do.

The answer that we came up with mixes PHP with perl. On most servers where PHP is installed you are certain to find perl as well. Though the perl manual strongly urges you to avoid tinkering with the raw post data, it's quite easy to manipulate it to create a pop that indicates upload percentage.

Then again most PHP programmers today aren't comfortable working with perl. So we will pass on the processing to a PHP script once file upload is complete. You are then back in familiar territory.

jlasman, thanks for the quick response. I've moved on to more pressing matters getting this site up and running but I'll definitely look into your suggestions.

 

[sullise]

Then, personally, I'd drop the whole idea of a progress bar...to me security over eyecandy is a no brainer.

There's this php extension..

http://pdoru.from.ro/