NYCPHP Meetup

[bz-gmort at beezifies.com]

Kenneth Dombrowski wrote:
> Hi Gary, 
>
> what does it complain about when you remove the error supression @s ? 
>   

It doesn't.  I am finding more and more web providers setup Apache to 
not give any error messages when something goes wrong.

This naturally makes it more difficult to troubleshoot the problem(and 
when they do not allow you command line access to run it manually in 
their environment...)
> also, i'm curious, why are the calls to substr() necessary? 
>   

It removes the trailing slash on the directory, which for some servers 
is necessary.  Since it is done for both directories, that should not be 
the problem.

> does shelling out to mkdir work? 
>
>  `mkdir -p /var/www/vhosts/mydomain.com/httpdocs/j/components/com_test/test`
>
> is this a cli script, or one you trigger via apache?  what user is
> running it & what exactly are the permissions? 
>   

It's triggered by Apache.  Actually, it's triggered by Joomla running 
under Apache to create a directory.  I simply tracked down where it was 
creating those directories and removed the extraneous bits and 
consolidated it down to the problematic function call(mkdir).



Interestingly, I expanded my script somewhat to determine:
A) The uid running the script
B) The uid which owns the first directory(they are the same, so both own 
the same directory)
C) I added an explicit call to chmod to set the first directory to 777
(this BTW is frustrating me to no end.  I can't count the number of 
providers who do not place the  web server in the same group as the user 
invoked for PHP scripts.   Mind you, I'm not asking that the PHP scripts 
be in the same group as Apache, ie access to all files apache can 
access, I want Apache to be in the group of each PHP user therefore 
giving it access to any files PHP creates) This is in the interest of 
security - and I understand the security concerns, but the result is 
people using these servers end up needing to set the security of their 
own files to 777 to get around the server problems.  Which means that 
they end up running less secure in the name of security)