Directory / File Mode

[zeeshanhashmi]

Hi

I have a script that generated some HTML pages, and also create directories. But what I did was I change the permission of the main directory public_html as 0777 through FTP.

Is this OK ? are there any security threats ?
Please let me know what is the proper way to do this ?

Further, I am using this function to create file and directory :

function createDir($dir_to_create,$mode)
{
    if (!file_exists($dir_to_create))
    {
        mkdir ($dir_to_create,$mode);
    }
} 

as I mentioned that main folder public_html has been set 0777 but the new created folders and files (through script) are not 0777 even i used this :

createDir("dirname",0777) 

please guide me
Thanks
Zeeshan

[Raju Gautam]

Further, I am using this function to create file and directory :
function createDir($dir_to_create,$mode){
if (!file_exists($dir_to_create)){
mkdir ($dir_to_create,$mode);
}
}

I dont think that

mkdir ($dir_to_create,$mode); 

will not create a file.

And don't create the directories directly in the public_html (root). If you are comfortable with creating new directory/files into a separate directory (like member directory under main root that is create earlier manually then create other directories inside it). I cant point out here a particular vulnerability now but giving full write permission to the root directory is not the good idea.
PHP Manual says:

The mode is 0777 by default, which means the widest possible access. For more information on modes, read the details on the chmod() page.

So you don't need to specify the mode while creating directories with mkdir(). If there is still problem try with chmod() once.

[sk89q]

There's something called umask that affects the permissions of filesystem objects you create.

Changing the permissions of your root web directory, or any directory, to be world-writable only has concerns if (1) there are other users on the server and there is no mechanism in place to prevent them from accessing your files, or (2) there's an exploit in your script. Otherwise, it's fine.