pset7 php file permissions

Question

I don't understand why php files should be set permission as unreadable except by the server? How can any one read a php file's code if it is interpreted automatically by the server before serving it to the user?

Also I need to know which user does Apache server acts as because in my server, the root folder and files of the Apache is owned to root user so which bits in file permissions are assigned to the server in that case? Root or group or everybody else?

Answer 1

PHP files that are intended to be run as part of a web application do not need to have the execute bit set chmod +x, because when the server finds a PHP file it executes the PHP interpreter, which then needs to have read access to the PHP source.

So, as the CS50 documentation will tell you, PHP files should be set chmod 600. Except that ever since version 59 of ide50, PHP files now require group-level read access: chmod 640. Note that world-level permissions are "0", or non-existent.

The exception to this rule is that when you intend to run a PHP file in a Terminal (generally, interactively at the command-line prompt) then you should set chmod 700 for that file, and also include a "shebang" line like:

#!/usr/bin/env php

at the beginning of the file.

Also, in Debian GNU/Linux (and Debian-derived distributions such as Ubuntu, which is what ide.cs50.io uses), the Apache server runs as user and group www-data.

Click here for further explanation.

Answer 2

Thanks Matt this made it more clear for me but I was just wondering why should we always make html files readable by everyone but php files not?! I mean isn't the server reads everything and serves it to the browser? So why don't we make all files readable only by the server? Also I don't understand how can someone read the php file even if it was readable by everyone? Shouldn't (s)he be using the server's computer to access the php file code? I am just confused about this. Thanks in advance