CHMOD 777 的替代方案
我正在用 JS 为不懂 HTML/CSS 的人开发一个 WYSIWYG 类型的网站构建器。一切都完成了，但我想让这尽可能简单。在完美的世界中，他们只需将所有文件上传到其主机即可完成。我遇到的问题是，我有一些文件和文件夹需要写入，但 PHP 没有权限，除非我将这些特定文件和文件夹 CHMOD 为 777。
我真的不想这样做，并希望我我有其他选择，也不想因为将 CHMOD 777 强加给每个人而受到批评。我可以做些什么（这对我的用户来说很简单）来允许 PHP 写入文件/文件夹，而不必向每个人授予权限？
我无法让 PHP 自己创建文件/文件夹，因为它也无权写入根目录。
I'm developing a WYSIWYG type site builder in JS for people who don't know HTML/CSS. It's all done, but I want to make this as simple as possible. In a perfect world, they'd just upload all the files to their host and be done with it. The problem I'm having is, I have some files and folders that need writing to, but PHP doesn't have permission unless I CHMOD those specific files and folders to 777.
I really don't want to do this and was hoping I had some alternative, nor do I want to be criticized for forcing CHMOD 777 upon everyone. Is there anything I can do (that would be simple for my users) to allow PHP to write to files/folders without having to grant permission to EVERYONE?
I can't have PHP create the files/folders itself because it doesn't have access to write to the root directory either.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
您可以将文件
chgrp发送到 Web 服务器的组（或 PHP 组，如果它设置为以自己的用户身份运行），然后对其进行chmod 770。但这不会给你带来太多安全保障。或者，您可以执行某些其他 PHP CMS（如 Joomla）所做的操作 - 当需要修改文件时，让服务器通过 FTP 连接回自身（使用站点所有者的凭据）并上传替换文件。
但说实话，您选择允许人们修改服务器上的文件的任何方式都会有其陷阱，并且安全性通常几乎与使整个站点可写一样糟糕。不管你怎么做，我建议你一定要确保你的身份验证和访问控制机制符合要求，因为你要自己承担这些责任，特别是当你允许网络用户编辑文件时。
You could
chgrpthe files to the web server's group (or PHP's, if it's set up to run as its own user) andchmod 770them. But that wouldn't get you much securitywise.Alternatively, you could do what some other PHP CMSes (like Joomla) do -- when a file needs to be modified, have the server connect back to itself via FTP (with the site owner's credentials) and upload the replacement file.
Truth be told, though, any way you choose to allow people to modify files on the server is going to have its pitfalls, and securitywise will generally be almost as bad as making the whole site world-writable. No matter how you do it, i suggest you make damn sure your authentication and access control mechanisms are up to snuff, as you're taking those responsibilities upon yourself especially when you allow web users to edit files.
让用户 CHMOD 777 根目录，让脚本创建新文件夹，然后让他们恢复根目录的权限。
Have the users CHMOD 777 the root directory, have your script create the new folder, and then have them restore the root directory's permissions.