cannot upload images through php in XAMPP (Mac)

Question

I am trying to allow users upload photos on a website. Here is my code: (i have edited parts from a code I got from a php tutorial online)

---

<form action="" method="POST" enctype="multipart/form-data">
    <?php echo 'shell_exec(whoami): '.shell_exec('whoami');?>
    <?php echo 'exec(whoami): '.exec('whoami');?>
    <?php echo 'Current script owner: ' . get_current_user(); ?> 

    <input type="file" name="upload_pic"/>
    <input type="submit" name="uploadpic" value="Upload Image">
</form>

<?php
if (isset($_POST['uploadpic'])) {
    $target_dir = "/userSphotos";
    $target_file = $target_dir . basename($_FILES["upload_pic"]["name"]);


    $uploads_dir = "/uploads";

    //can only upload jpeg,png,gif && under 1MB(size=1048576)
    if ((($_FILES["upload_pic"]["type"]=="image/jpeg") || ($_FILES["upload_pic"]["type"]=="image/png") || ($_FILES["upload_pic"]["type"]=="image/gif"))&&($_FILES["upload_pic"]["size"] < 1048576)) { //1 Megabyte 

    $name = $_FILES["upload_pic"]["name"];


            if (    move_uploaded_file($_FILES["upload_pic"]["tmp_name"], "$uploads_dir")    ) {
                echo "The file ". basename( $_FILES["upload_pic"]["name"]). " has been uploaded.";
            }
            else{
                echo "Sorry, there was an error uploading your file.";
            }

when I run it in chrome, I get the error:

Warning: move_uploaded_file(/uploads): failed to open stream:

Permission denied in

Warning: move_uploaded_file(): Unable to move

Sorry, there was an error uploading your file.

It seems that I'm getting errors because the code is unable to access certain folders that have different owners/users. I tried to get and edit the owners/users for all the folders, but it still doesn't work.

when i run

<?php echo 'shell_exec(whoami): '.shell_exec('whoami');?>
<?php echo 'exec(whoami): '.exec('whoami');?>
<?php echo 'Current script owner: ' . get_current_user(); ?>

I get 'mymac' for all three lines. I think it means the php owner is 'mymac'.I probably had 'daemon' for shell_exec(whoami) and exec(whoami) the first time, but I edited things a multiple times through terminal while I was trying to debug this.

In terminal, I have tried changing the owner of the 'uploads' folder and 'temp' folder to 'mymac' by

sudo chown

and changed the setting to 755 for both folders by:

sudo chmod -R 0755

and it still doesn't work I haven't tried 777 because of security issues.

for

ps aux | grep https

I get 'mymac' in the in the first column except for one row, where 'root' is the first value. Again, I think I originally had' daemon', but it changed after switched the apache user to mymac in the httpd.conf file.

At one point, I also tried editing the Apache's user to 'mymac' in its httpd.conf file by pico (/private/etc/apache2/httpd.conf) in terminal. And it still does not work.

To summarize, I think I have all the owners/users of the "uploads" folder, "temp" folder, Apache and php ad 'mymac', but the code still does not have permission to access the folders.

Also, restarted my laptop and my Apache Web Server doesn't even start now

Answer 1

One problem is that the second argument to move_uploaded_file() function must be full path including file name, not a directory. See this example on php.net:

$uploaddir = '/var/www/uploads/';
$uploadfile = $uploaddir . basename($_FILES['userfile']['name']);
move_uploaded_file($_FILES['userfile']['tmp_name'], $uploadfile);

Also bear in mind that the destination path is an absolute path. Your /uploads folder is at the root of the filesystem.