Secure Mode and implications for development

[Evoir]

Hi, I am working with a programmer, and I am trying to find some information for him about working in secure mode. I couldn't find much documentation about it... Here's what he writes:

"We have run into some issues with the file uploads for images and PDF files. The FQ server security is so strong that is making difficult for us to work. There are weird file permissions between the apache user and the xdomain user when files are uploaded. It’s hard to explain, and I can get back to you with exactly what I need so you can forward the request to FQ. For now, product images are not enabled."

Is there a page on FQ that has documentaion about Secure Mode that I can share with him?

[Terra]

There is no technical documentation regarding Secure_Mode™, as there really aren't any problems to work around while running within its environment...

Does this address the upload issue?
http://www.aota.net/forums/showthread.php?t=14690&highlight=php+file+upload+mode+600

That is more a quirk of PHP and not anything related to Secure_Mode...

--
Terra
--Secure_Mode™ has stood the test of time, and still remains exclusive to us--
FutureQuest

[Matt]

Evie,

I have noticed a few oddities with file permissions on files uploaded via a PHP script. Specifically, I have seen instances where a graphic is uploaded via a PHP script and is then not viewable by Apache (causing a broken image to appear on a page). The solution is simply chmodding the file to whatever is appropriate. Although this might seem a bit inconvenient, I can tell you that it is MUCH simpler knowing that PHP scripts are executing under your username than having to go in and mark certain directories readable by all (or worse, writable by all).

An experienced programmer should have no difficulty at all w/ FQ's system. I suspect he/ she is making it more complicated than is necessary. FQ's method is analogous to the suEXEC feature commonly implemented for CGI scripts. FQ has really taken a giant step forward in offering similar security for PHP scripts.

-Matt

[Evoir]

Thanks. I've passed on the info. :)