php - Is setting the uploads folder 777 permission secure?

Question

I have seen a lot of upload forms hacked, and some had some really good security checks of the file being uploaded (at least I think so), but still somebody managed to upload a PHP file.

I was wondering: is there is a way to upload a file in the uploads folder that has 777 permissions? I am thinking of using HTTP PUT.

Answer 1

In general 777 is about as insecure as it gets... that means anybody can read and write to your files.

HTTP PUT isn't inherently any more secure than HTTP POST if you're allowing the uploaded files to be exceuted on your server.

Overall, if you are allowing arbitrary files to be executed you need to be doing very good file checking server-side, and using chroot on the server would be wise.

Permission-wise, I generally set anything web-accessible to 644 owned by the webserver user.