Avoid user to go ../../ [closed]

Question

I have LAMP installed in my server and I use virtualhosts to map domains to subdirectories. I need to allow my customers to upload files (including php) to their server using FTP.

The problem is that a customer using a domain xxx.com.br uploaded a file test.php and executed it like:

xxx.com.br/test.php

The content of test.php if file_put_contents("../../xxx.txt","teste") and it worked! The file xxx.txt was created 2 levels above his domain folder! How do I prevent this from happening?

Answer 1

Don't give the PHP process access to directories it isn't meant to reach.

That's kind of the point of the whole permission system.

In Linux, PHP will generally run as its own user, just make sure that user doesn't have read or write permission to any files you don't want exposed.