Unable to upload images specifically on DigitalOcean Server

@faheem1

What do the permissions look like for:

/var/
/var/www
/var/www/html
/var/www/html/contents
/var/www/html/contents/individual
/var/www/html/contents/individual/personal

If your web root is www (i.e. where index.php is), from www down to personal should be owned by the same user & group (i.e. www-data) if that’s who PHP is being run as (in the case of using PHP-FPM or FastCGI).

–

Security Alert

From a security standpoint, neither files or directories should have permissions set to 0777, which is what drwxrwxrwx implies.

The d tells us that it’s a directory while rwx (Read, Write, Execute) is set for Owner, Group and Other (where Other is anyone that is not the Owner and not in the Group). For the directories above, rwx is set for all three of the groups, which is the equivalent of a chmod 777 or chmod 0777.

Ideally, all directories should have a chmod no higher than 0755 and PHP files 0644. Of course, if you can get away with more restrictive permissions, that’s a plus.

Why?

Having a chmod of 777 on files or directories, as noted above, gives world-writable permissions. In many cases, when files are written to a directory, they inherit the same permissions unless otherwise set (by your script). Let’s say that one user uploads an image that really isn’t an image, it’s a PHP script in disguise (this could be the case even if it has an image extension). Should this image go by without validation, you now have a script on your server that can do whatever the uploading user wants when they call it. This could be a simple shell command using PHP’s shell_exec() function which runs a rm -rf on your entire directory (which would delete everything in it, thus rendering it unrecoverable).

Hopefully you’ve implemented some validation that prevents this sort of thing from being possible, but this is one example.