Coldfusion on Linux - cannot change permissions on a file

Question

I've been banging my head against the wall on this one. I have a system that allows a user to FTP a zip file to the server. Then in the admin they can tell the application where this file is so a set of actions can be performed on the file.

1. Move the file out of the web root
2. Unzip the file
3. List the contents and insert data into database

Problem is, the file uploaded does not always have the proper permissions. I've tried changing them with the following:

<cfscript>
    FileSetAccessMode(myFile, "777");
</cfscript>

And

<cffile action="rename" mode="777" source="#myFile#" destination="#myFile#">        

And

    <cffile action="move" mode="777" source="#myFile#" destination="#myFile#">      

But nothing will change the permission of this zip file. Note that if I perform any of the above actions on an image (.jpg) it works fine. Am I missing something?

Answer 1

The FTP'd files are unlikely to be owned by the webserver process, unless you FTP in with the same credentials as the webserver's running under. Unless the webserver owns the files, it won't be able to change the permissions on them.

Answer 2

If the Web server/ColdFusion server can read the file, have it copy it to a staging area and then delete the original file. If CF has write (and possible execute) permission to the FOLDER it should be able to delete the original file regardless of who owns it, even if it's set to mode 000 (no access for anyone).

Having uploads be placed in a sandbox and then moved to where the server expects them is a good security practice in any event.