I am trying to configure PHP sessions for suPHP (see here ). I need my php verification file to belong to the user, so that when suPHP starts, it will do it for the correct user. However, I also do not want the user to have access to this file, ow they can edit it to just return true, and then check the database.
My first attempt was something like this (where Apache works as a www-data user)
/etc/validate ├── [drwx------ www-data ] user1 │ └── [-rwx------ user1 ] validate.php /var/www/ └── [drwx------ user1 ] user1 └── [-rwx------ user1 ] index.html
Then redirect the web pages to the verification page that will be checked, and then return /var/www/user1/index.html
RewriteCond %{REQUEST_URI} !^/xyz RewriteRule ^(.*) /etc/validate/user1/validate.php?uri=$1
However, suPHP complains that I am accessing something outside of my docroot ( /var/www/user1 ). I do not want docroot to / and update the suphp.conf file suphp.conf that check_vhost_docroot=false does not fix it (and I do not want to fix it). So instead, I just moved /etc/validate to /var/www like that (it's a little dirty, I know)
/var/www/ └── [drwx------ user1 ] user1 ├── [-rwx------ user1 ] index.html └── [dr-x------ www-data ] validate └── [-rwx------ user1 ] validate.php
So, now the confirmation file
- Inside docroot
- Owned by user1
- Not editable by user1
But now, if I try to load the page, I get the following error
Directory /var/www/user1/validate is not owned by user1
At this point, I'm losing patience, so I just insert another stub folder there, so the file structure looks like this
/var/www/ └── [drwx------ user1 ] user1 ├── [-rwx------ user1 ] index.html └── [dr-x------ www-data ] validate └── [drwx------ user1 ] dummy └── [-rwx------ user1 ] validate.php
Now when I try to load the page, Apache tells me: "You do not have permission to access xyz on this server." where xyz is what comes after my domain name. I do not know why Apache tells me this because I am not trying to access the final values as a file / folder. I think the redirect does not work, and Apache simply assumes that it is a hard link that fails.
Can someone tell me what I'm doing wrong, or provide an alternative way to prevent users from editing their files. It could not get into the dummy directory, since its permissions were rwx------ , and only user1 could cd into it. When I changed the permissions from 0700 to 0755 , it returned to suPHP errors. So now the question is: how can I get suPHP to execute scripts when one of its directories above belongs to someone else?
EDIT: Now I understand why Apache complained. He could not get into